* [PATCH] Input: sidewinder - size the name buffers to their formats @ 2026-11-06 3:33 xujiahao 2026-11-08 6:33 ` Dmitry Torokhov 2026-11-09 1:05 ` [PATCH v2] Input: sidewinder - use scnprintf() for the port names xujiahao 0 siblings, 2 replies; 5+ messages in thread From: xujiahao @ 2026-11-06 3:33 UTC (permalink / raw) To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, xujiahao sw_connect() composes the physical path of each port as "%s/input%d" from gameport->phys into a 32-byte array. gameport->phys is a 32-byte string and the port number is an int, so the worst case is 31 + 6 + 10 characters plus the terminator and does not fit. sw_3dp_id() builds " [PnP %d.%02d id %s rev %s]" into the 40-byte comment buffer of sw_connect(). The PnP ID is 7 characters, the revision string 8, and the %d arguments are a full-range int as far as the compiler can tell, so 44 characters plus the terminator do not fit either. Size both buffers to their formats. Truncation is theoretical with the values seen today, but a buffer should not be smaller than what it is asked to hold. Building with W=1: drivers/input/joystick/sidewinder.c:538:58: warning: '%s' directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=] drivers/input/joystick/sidewinder.c:727:29: warning: '/input' directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=] Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com> --- drivers/input/joystick/sidewinder.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c index 7f37d18c8..2bd5cfe5c 100644 --- a/drivers/input/joystick/sidewinder.c +++ b/drivers/input/joystick/sidewinder.c @@ -97,7 +97,7 @@ struct sw { struct gameport *gameport; struct input_dev *dev[4]; char name[64]; - char phys[4][32]; + char phys[4][64]; int length; int type; int bits; @@ -574,7 +574,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv) unsigned char *buf = NULL; /* [SW_LENGTH] */ unsigned char *idbuf = NULL; /* [SW_LENGTH] */ unsigned char m = 1; - char comment[40]; + char comment[48]; comment[0] = 0; -- 2.43.0 ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH] Input: sidewinder - size the name buffers to their formats 2026-11-06 3:33 [PATCH] Input: sidewinder - size the name buffers to their formats xujiahao @ 2026-11-08 6:33 ` Dmitry Torokhov 2026-11-09 1:05 ` [PATCH v2] Input: sidewinder - use scnprintf() for the port names xujiahao 1 sibling, 0 replies; 5+ messages in thread From: Dmitry Torokhov @ 2026-11-08 6:33 UTC (permalink / raw) To: xujiahao; +Cc: linux-input, linux-kernel On Fri, Nov 06, 2026 at 11:33:00AM +0800, xujiahao wrote: > sw_connect() composes the physical path of each port as "%s/input%d" > from gameport->phys into a 32-byte array. gameport->phys is a 32-byte > string and the port number is an int, so the worst case is 31 + 6 + 10 > characters plus the terminator and does not fit. > > sw_3dp_id() builds " [PnP %d.%02d id %s rev %s]" into the 40-byte > comment buffer of sw_connect(). The PnP ID is 7 characters, the > revision string 8, and the %d arguments are a full-range int as far as > the compiler can tell, so 44 characters plus the terminator do not fit > either. > > Size both buffers to their formats. Truncation is theoretical with the > values seen today, but a buffer should not be smaller than what it is > asked to hold. Building with W=1: > > drivers/input/joystick/sidewinder.c:538:58: warning: '%s' directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=] > drivers/input/joystick/sidewinder.c:727:29: warning: '/input' directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=] > > Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com> > --- > drivers/input/joystick/sidewinder.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c > index 7f37d18c8..2bd5cfe5c 100644 > --- a/drivers/input/joystick/sidewinder.c > +++ b/drivers/input/joystick/sidewinder.c > @@ -97,7 +97,7 @@ struct sw { > struct gameport *gameport; > struct input_dev *dev[4]; > char name[64]; > - char phys[4][32]; > + char phys[4][64]; > int length; > int type; > int bits; > @@ -574,7 +574,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv) > unsigned char *buf = NULL; /* [SW_LENGTH] */ > unsigned char *idbuf = NULL; /* [SW_LENGTH] */ > unsigned char m = 1; > - char comment[40]; > + char comment[48]; This just wastes memory for something that never happens. We are OK even if data is truncated. To shut off the warnings I think we can switch to scnprintf(). Thanks. -- Dmitry ^ permalink raw reply [flat|nested] 5+ messages in thread
* [PATCH v2] Input: sidewinder - use scnprintf() for the port names 2026-11-06 3:33 [PATCH] Input: sidewinder - size the name buffers to their formats xujiahao 2026-11-08 6:33 ` Dmitry Torokhov @ 2026-11-09 1:05 ` xujiahao 2026-11-09 10:45 ` kernel test robot 2026-11-09 20:08 ` kernel test robot 1 sibling, 2 replies; 5+ messages in thread From: xujiahao @ 2026-11-09 1:05 UTC (permalink / raw) To: Dmitry Torokhov; +Cc: linux-input, linux-kernel, xujiahao sw_connect() composes the physical path of each port as "%s/input%d" from gameport->phys into a 32-byte array, and sw_3dp_id() builds " [PnP %d.%02d id %s rev %s]" into the 40-byte comment buffer of sw_connect(). GCC reports that both formats can overflow their buffers in a W=1 build: drivers/input/joystick/sidewinder.c:538:58: warning: ‘%s’ directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=] drivers/input/joystick/sidewinder.c:727:29: warning: ‘/input’ directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=] The values seen in practice fit these buffers, and a truncated name is harmless, so keep the sizes as they are and switch to scnprintf() to make the truncation explicit instead of letting the compiler warn about a possible one. Link: https://lore.kernel.org/all/20261106033300.3439313-1-xujiahao@cmss.chinamobile.com/ Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com> Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com> --- drivers/input/joystick/sidewinder.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c index 7f37d18c8..bca81df19 100644 --- a/drivers/input/joystick/sidewinder.c +++ b/drivers/input/joystick/sidewinder.c @@ -535,12 +535,12 @@ static void sw_3dp_id(unsigned char *buf, char *comment, size_t size) pnp[7] = rev[8] = 0; - snprintf(comment, size, " [PnP %d.%02d id %s rev %s]", - (int) ((sw_get_bits(buf, 8, 6, 1) << 6) | /* Two 6-bit values */ - sw_get_bits(buf, 16, 6, 1)) / 100, - (int) ((sw_get_bits(buf, 8, 6, 1) << 6) | - sw_get_bits(buf, 16, 6, 1)) % 100, - pnp, rev); + scnprintf(comment, size, " [PnP %d.%02d id %s rev %s]", + (int)(((sw_get_bits(buf, 8, 6, 1) << 6) | /* Two 6-bit values */ + sw_get_bits(buf, 16, 6, 1)) / 100), + (int)(((sw_get_bits(buf, 8, 6, 1) << 6) | + sw_get_bits(buf, 16, 6, 1)) % 100), + pnp, rev); } /* @@ -723,8 +723,8 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv) snprintf(sw->name, sizeof(sw->name), "Microsoft SideWinder %s", sw_name[sw->type]); - snprintf(sw->phys[i], sizeof(sw->phys[i]), - "%s/input%d", gameport->phys, i); + scnprintf(sw->phys[i], sizeof(sw->phys[i]), + "%s/input%d", gameport->phys, i); sw->dev[i] = input_dev = input_allocate_device(); if (!input_dev) { -- 2.43.0 ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] Input: sidewinder - use scnprintf() for the port names 2026-11-09 1:05 ` [PATCH v2] Input: sidewinder - use scnprintf() for the port names xujiahao @ 2026-11-09 10:45 ` kernel test robot 2026-11-09 20:08 ` kernel test robot 1 sibling, 0 replies; 5+ messages in thread From: kernel test robot @ 2026-11-09 10:45 UTC (permalink / raw) To: xujiahao, Dmitry Torokhov Cc: oe-kbuild-all, linux-input, linux-kernel, xujiahao Hi xujiahao, kernel test robot noticed the following build errors: [auto build test ERROR on dtor-input/next] [also build test ERROR on dtor-input/for-linus hid/for-next linus/master v7.4-rc2 next-20261105] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/xujiahao/Input-sidewinder-use-scnprintf-for-the-port-names/20261109-090548 base: https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git next patch link: https://lore.kernel.org/r/20261109010548.438699-1-xujiahao%40cmss.chinamobile.com patch subject: [PATCH v2] Input: sidewinder - use scnprintf() for the port names config: arm-randconfig-1000-20261109 (https://download.01.org/0day-ci/archive/20261109/202611091814.ChpgVgpE-lkp@intel.com/config) compiler: arm-linux-gnueabi-gcc (GCC) 10.5.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261109/202611091814.ChpgVgpE-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202611091814.ChpgVgpE-lkp@intel.com/ All errors (new ones prefixed by >>): arm-linux-gnueabi-ld: drivers/input/joystick/sidewinder.o: in function `sw_3dp_id.constprop.0': >> sidewinder.c:(.text+0xa52): undefined reference to `__aeabi_uldivmod' >> arm-linux-gnueabi-ld: sidewinder.c:(.text+0xa66): undefined reference to `__aeabi_uldivmod' -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH v2] Input: sidewinder - use scnprintf() for the port names 2026-11-09 1:05 ` [PATCH v2] Input: sidewinder - use scnprintf() for the port names xujiahao 2026-11-09 10:45 ` kernel test robot @ 2026-11-09 20:08 ` kernel test robot 1 sibling, 0 replies; 5+ messages in thread From: kernel test robot @ 2026-11-09 20:08 UTC (permalink / raw) To: xujiahao, Dmitry Torokhov Cc: oe-kbuild-all, linux-input, linux-kernel, xujiahao Hi xujiahao, kernel test robot noticed the following build errors: [auto build test ERROR on dtor-input/next] [also build test ERROR on dtor-input/for-linus hid/for-next linus/master v7.4-rc2 next-20261109] [If your patch is applied to the wrong git tree, kindly drop us a note. And when submitting patch, we suggest to use '--base' as documented in https://git-scm.com/docs/git-format-patch#_base_tree_information] url: https://github.com/intel-lab-lkp/linux/commits/xujiahao/Input-sidewinder-use-scnprintf-for-the-port-names/20261109-090548 base: https://git.kernel.org/pub/scm/linux/kernel/git/dtor/input.git next patch link: https://lore.kernel.org/r/20261109010548.438699-1-xujiahao%40cmss.chinamobile.com patch subject: [PATCH v2] Input: sidewinder - use scnprintf() for the port names config: i386-randconfig-1006-20261109 (https://download.01.org/0day-ci/archive/20261110/202611100328.QAelfSpD-lkp@intel.com/config) compiler: gcc-14 (Debian 14.2.0-19) 14.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20261110/202611100328.QAelfSpD-lkp@intel.com/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@intel.com> | Closes: https://lore.kernel.org/oe-kbuild-all/202611100328.QAelfSpD-lkp@intel.com/ All errors (new ones prefixed by >>): ld: drivers/input/joystick/sidewinder.o: in function `sw_3dp_id': >> drivers/input/joystick/sidewinder.c:542:(.text+0x1630): undefined reference to `__umoddi3' >> ld: drivers/input/joystick/sidewinder.c:540:(.text+0x1652): undefined reference to `__udivdi3' vim +542 drivers/input/joystick/sidewinder.c 519 520 /* 521 * sw_3dp_id() translates the 3DP id into a human legible string. 522 * Unfortunately I don't know how to do this for the other SW types. 523 */ 524 525 static void sw_3dp_id(unsigned char *buf, char *comment, size_t size) 526 { 527 int i; 528 char pnp[8], rev[9]; 529 530 for (i = 0; i < 7; i++) /* ASCII PnP ID */ 531 pnp[i] = sw_get_bits(buf, 24+8*i, 8, 1); 532 533 for (i = 0; i < 8; i++) /* ASCII firmware revision */ 534 rev[i] = sw_get_bits(buf, 88+8*i, 8, 1); 535 536 pnp[7] = rev[8] = 0; 537 538 scnprintf(comment, size, " [PnP %d.%02d id %s rev %s]", 539 (int)(((sw_get_bits(buf, 8, 6, 1) << 6) | /* Two 6-bit values */ > 540 sw_get_bits(buf, 16, 6, 1)) / 100), 541 (int)(((sw_get_bits(buf, 8, 6, 1) << 6) | > 542 sw_get_bits(buf, 16, 6, 1)) % 100), 543 pnp, rev); 544 } 545 -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki ^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-11-09 20:09 UTC | newest] Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed) -- links below jump to the message on this page -- 2026-11-06 3:33 [PATCH] Input: sidewinder - size the name buffers to their formats xujiahao 2026-11-08 6:33 ` Dmitry Torokhov 2026-11-09 1:05 ` [PATCH v2] Input: sidewinder - use scnprintf() for the port names xujiahao 2026-11-09 10:45 ` kernel test robot 2026-11-09 20:08 ` kernel test robot
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®