[PATCH] scsi: st: Avoid truncating the tape name for large tape numbers

[PATCH] scsi: st: Avoid truncating the tape name for large tape numbers

[xujiahao]

create_one_cdev() builds the class device name in a 10-byte buffer as
"n" (no-rewind devices) + tape->name + a one-character mode suffix.
tape->name is a DISK_NAME_LEN (32) byte array holding "st%d", and the
tape index comes from an idr with an upper bound of ST_MAX_TAPES - 1
(131071, six digits), so "n" + "st131071" + suffix + terminator needs
11 bytes.  Names of tapes with large index numbers are truncated today
and lose the mode suffix, which leaves the rewind modes of such a tape
with the same name.

Size the buffer after the actual requirement, DISK_NAME_LEN + 2, and
pass sizeof(name) to snprintf() so the two cannot drift apart again.

GCC reports with -Wformat-truncation=2:

  drivers/scsi/st.c:4393:31: warning: '%s' directive output may be truncated writing up to 31 bytes into a region of size between 9 and 10 [-Wformat-truncation=]

Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
---
 drivers/scsi/st.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index e9d41e3cc..311781987 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4366,7 +4366,7 @@ static int create_one_cdev(struct scsi_tape *tape, int mode, int rew)
 	struct cdev *cdev;
 	struct device *dev;
 	struct st_modedef *STm = &(tape->modes[mode]);
-	char name[10];
+	char name[DISK_NAME_LEN + 2];
 	int dev_num = tape->index;
 
 	cdev_devno = MKDEV(SCSI_TAPE_MAJOR, TAPE_MINOR(dev_num, mode, rew));
@@ -4390,7 +4390,7 @@ static int create_one_cdev(struct scsi_tape *tape, int mode, int rew)
 	}
 
 	i = mode << (4 - ST_NBR_MODE_BITS);
-	snprintf(name, 10, "%s%s%s", rew ? "n" : "",
+	snprintf(name, sizeof(name), "%s%s%s", rew ? "n" : "",
 		 tape->name, st_formats[i]);
 
 	dev = device_create(&st_sysfs_class, &tape->device->sdev_gendev,
-- 
2.43.0

Re: [PATCH] scsi: st: Avoid truncating the tape name for large tape numbers

[Laurence Oberman]

On Fri, 2026-11-06 at 10:17 +0800, xujiahao wrote:
> create_one_cdev() builds the class device name in a 10-byte buffer as
> "n" (no-rewind devices) + tape->name + a one-character mode suffix.
> tape->name is a DISK_NAME_LEN (32) byte array holding "st%d", and the
> tape index comes from an idr with an upper bound of ST_MAX_TAPES - 1
> (131071, six digits), so "n" + "st131071" + suffix + terminator needs
> 11 bytes.  Names of tapes with large index numbers are truncated
> today
> and lose the mode suffix, which leaves the rewind modes of such a
> tape
> with the same name.
> 
> Size the buffer after the actual requirement, DISK_NAME_LEN + 2, and
> pass sizeof(name) to snprintf() so the two cannot drift apart again.
> 
> GCC reports with -Wformat-truncation=2:
> 
>   drivers/scsi/st.c:4393:31: warning: '%s' directive output may be
> truncated writing up to 31 bytes into a region of size between 9 and
> 10 [-Wformat-truncation=]
> 
> Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
> ---
>  drivers/scsi/st.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
> index e9d41e3cc..311781987 100644
> --- a/drivers/scsi/st.c
> +++ b/drivers/scsi/st.c
> @@ -4366,7 +4366,7 @@ static int create_one_cdev(struct scsi_tape
> *tape, int mode, int rew)
>  	struct cdev *cdev;
>  	struct device *dev;
>  	struct st_modedef *STm = &(tape->modes[mode]);
> -	char name[10];
> +	char name[DISK_NAME_LEN + 2];
>  	int dev_num = tape->index;
>  
>  	cdev_devno = MKDEV(SCSI_TAPE_MAJOR, TAPE_MINOR(dev_num,
> mode, rew));
> @@ -4390,7 +4390,7 @@ static int create_one_cdev(struct scsi_tape
> *tape, int mode, int rew)
>  	}
>  
>  	i = mode << (4 - ST_NBR_MODE_BITS);
> -	snprintf(name, 10, "%s%s%s", rew ? "n" : "",
> +	snprintf(name, sizeof(name), "%s%s%s", rew ? "n" : "",
>  		 tape->name, st_formats[i]);
>  
>  	dev = device_create(&st_sysfs_class, &tape->device-
> >sdev_gendev,

Hi,

Thanks for the patch.

The arithmetic is correct, but the truncation only occurs with tape
indices >= 100000, which is not a configuration anyone will
realistically
have. So this addresses a W=2 format-truncation warning rather than a
real-world problem, and I'd prefer not to churn st.c for that.

NAK for now.

Regards,
Laurence