[PATCH] pinctrl: s32cc: Avoid possible string truncation

[PATCH] pinctrl: s32cc: Avoid possible string truncation

[Chester Lin]

With "W=1" and "-Wformat-truncation" build options, the kernel test robot
found a possible string truncation warning in pinctrl-s32cc.c, which uses
an 8-byte char array to hold a memory region name "map%u". Since the
maximum number of digits that a u32 value can present is 10, and the "map"
string occupies 3 bytes with a termination '\0', which means the rest 4
bytes cannot fully present the integer "X" that exceeds 4 digits.

Here we check if the number >= 10000, which is the lowest value that
contains more than 4 digits.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202311030159.iyUGjNGF-lkp@intel.com/
Signed-off-by: Chester Lin <clin@suse.com>
---
 drivers/pinctrl/nxp/pinctrl-s32cc.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pinctrl/nxp/pinctrl-s32cc.c b/drivers/pinctrl/nxp/pinctrl-s32cc.c
index 7daff9f186cd..7735d30f2be3 100644
--- a/drivers/pinctrl/nxp/pinctrl-s32cc.c
+++ b/drivers/pinctrl/nxp/pinctrl-s32cc.c
@@ -843,8 +843,8 @@ static int s32_pinctrl_probe_dt(struct platform_device *pdev,
 	if (!np)
 		return -ENODEV;
 
-	if (mem_regions == 0) {
-		dev_err(&pdev->dev, "mem_regions is 0\n");
+	if (mem_regions == 0 || mem_regions >= 10000) {
+		dev_err(&pdev->dev, "mem_regions is invalid: %u\n", mem_regions);
 		return -EINVAL;
 	}
 
-- 
2.40.0

Re: [PATCH] pinctrl: s32cc: Avoid possible string truncation

[Linus Walleij]

On Tue, Nov 7, 2023 at 3:10 PM Chester Lin <clin@suse.com> wrote:

> With "W=1" and "-Wformat-truncation" build options, the kernel test robot
> found a possible string truncation warning in pinctrl-s32cc.c, which uses
> an 8-byte char array to hold a memory region name "map%u". Since the
> maximum number of digits that a u32 value can present is 10, and the "map"
> string occupies 3 bytes with a termination '\0', which means the rest 4
> bytes cannot fully present the integer "X" that exceeds 4 digits.
>
> Here we check if the number >= 10000, which is the lowest value that
> contains more than 4 digits.
>
> Reported-by: kernel test robot <lkp@intel.com>
> Closes: https://lore.kernel.org/oe-kbuild-all/202311030159.iyUGjNGF-lkp@intel.com/
> Signed-off-by: Chester Lin <clin@suse.com>

Thanks for fixing this!
Patch applied for fixes.

Yours,
Linus Walleij