* Re: [PATCH] Input: sidewinder - size the name buffers to their formats
2026-11-06 3:33 [PATCH] Input: sidewinder - size the name buffers to their formats xujiahao
@ 2026-11-08 6:33 ` Dmitry Torokhov
2026-11-09 1:05 ` [PATCH v2] Input: sidewinder - use scnprintf() for the port names xujiahao
1 sibling, 0 replies; 4+ messages in thread
From: Dmitry Torokhov @ 2026-11-08 6:33 UTC (permalink / raw)
To: xujiahao; +Cc: linux-input, linux-kernel
On Fri, Nov 06, 2026 at 11:33:00AM +0800, xujiahao wrote:
> sw_connect() composes the physical path of each port as "%s/input%d"
> from gameport->phys into a 32-byte array. gameport->phys is a 32-byte
> string and the port number is an int, so the worst case is 31 + 6 + 10
> characters plus the terminator and does not fit.
>
> sw_3dp_id() builds " [PnP %d.%02d id %s rev %s]" into the 40-byte
> comment buffer of sw_connect(). The PnP ID is 7 characters, the
> revision string 8, and the %d arguments are a full-range int as far as
> the compiler can tell, so 44 characters plus the terminator do not fit
> either.
>
> Size both buffers to their formats. Truncation is theoretical with the
> values seen today, but a buffer should not be smaller than what it is
> asked to hold. Building with W=1:
>
> drivers/input/joystick/sidewinder.c:538:58: warning: '%s' directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
> drivers/input/joystick/sidewinder.c:727:29: warning: '/input' directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]
>
> Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
> ---
> drivers/input/joystick/sidewinder.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
> index 7f37d18c8..2bd5cfe5c 100644
> --- a/drivers/input/joystick/sidewinder.c
> +++ b/drivers/input/joystick/sidewinder.c
> @@ -97,7 +97,7 @@ struct sw {
> struct gameport *gameport;
> struct input_dev *dev[4];
> char name[64];
> - char phys[4][32];
> + char phys[4][64];
> int length;
> int type;
> int bits;
> @@ -574,7 +574,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
> unsigned char *buf = NULL; /* [SW_LENGTH] */
> unsigned char *idbuf = NULL; /* [SW_LENGTH] */
> unsigned char m = 1;
> - char comment[40];
> + char comment[48];
This just wastes memory for something that never happens. We are OK even
if data is truncated.
To shut off the warnings I think we can switch to scnprintf().
Thanks.
--
Dmitry
^ permalink raw reply [flat|nested] 4+ messages in thread* [PATCH v2] Input: sidewinder - use scnprintf() for the port names
2026-11-06 3:33 [PATCH] Input: sidewinder - size the name buffers to their formats xujiahao
2026-11-08 6:33 ` Dmitry Torokhov
@ 2026-11-09 1:05 ` xujiahao
2026-11-09 10:45 ` kernel test robot
1 sibling, 1 reply; 4+ messages in thread
From: xujiahao @ 2026-11-09 1:05 UTC (permalink / raw)
To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, xujiahao
sw_connect() composes the physical path of each port as "%s/input%d"
from gameport->phys into a 32-byte array, and sw_3dp_id() builds
" [PnP %d.%02d id %s rev %s]" into the 40-byte comment buffer of
sw_connect(). GCC reports that both formats can overflow their buffers
in a W=1 build:
drivers/input/joystick/sidewinder.c:538:58: warning: ‘%s’ directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
drivers/input/joystick/sidewinder.c:727:29: warning: ‘/input’ directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]
The values seen in practice fit these buffers, and a truncated name is
harmless, so keep the sizes as they are and switch to scnprintf() to
make the truncation explicit instead of letting the compiler warn about
a possible one.
Link: https://lore.kernel.org/all/20261106033300.3439313-1-xujiahao@cmss.chinamobile.com/
Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
---
drivers/input/joystick/sidewinder.c | 16 ++++++++--------
1 file changed, 8 insertions(+), 8 deletions(-)
diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
index 7f37d18c8..bca81df19 100644
--- a/drivers/input/joystick/sidewinder.c
+++ b/drivers/input/joystick/sidewinder.c
@@ -535,12 +535,12 @@ static void sw_3dp_id(unsigned char *buf, char *comment, size_t size)
pnp[7] = rev[8] = 0;
- snprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
- (int) ((sw_get_bits(buf, 8, 6, 1) << 6) | /* Two 6-bit values */
- sw_get_bits(buf, 16, 6, 1)) / 100,
- (int) ((sw_get_bits(buf, 8, 6, 1) << 6) |
- sw_get_bits(buf, 16, 6, 1)) % 100,
- pnp, rev);
+ scnprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
+ (int)(((sw_get_bits(buf, 8, 6, 1) << 6) | /* Two 6-bit values */
+ sw_get_bits(buf, 16, 6, 1)) / 100),
+ (int)(((sw_get_bits(buf, 8, 6, 1) << 6) |
+ sw_get_bits(buf, 16, 6, 1)) % 100),
+ pnp, rev);
}
/*
@@ -723,8 +723,8 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
snprintf(sw->name, sizeof(sw->name),
"Microsoft SideWinder %s", sw_name[sw->type]);
- snprintf(sw->phys[i], sizeof(sw->phys[i]),
- "%s/input%d", gameport->phys, i);
+ scnprintf(sw->phys[i], sizeof(sw->phys[i]),
+ "%s/input%d", gameport->phys, i);
sw->dev[i] = input_dev = input_allocate_device();
if (!input_dev) {
--
2.43.0
^ permalink raw reply [flat|nested] 4+ messages in thread