[PATCH] Input: sidewinder - size the name buffers to their formats

[PATCH] Input: sidewinder - size the name buffers to their formats

[xujiahao]

sw_connect() composes the physical path of each port as "%s/input%d"
from gameport->phys into a 32-byte array.  gameport->phys is a 32-byte
string and the port number is an int, so the worst case is 31 + 6 + 10
characters plus the terminator and does not fit.

sw_3dp_id() builds " [PnP %d.%02d id %s rev %s]" into the 40-byte
comment buffer of sw_connect().  The PnP ID is 7 characters, the
revision string 8, and the %d arguments are a full-range int as far as
the compiler can tell, so 44 characters plus the terminator do not fit
either.

Size both buffers to their formats.  Truncation is theoretical with the
values seen today, but a buffer should not be smaller than what it is
asked to hold.  Building with W=1:

  drivers/input/joystick/sidewinder.c:538:58: warning: '%s' directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
  drivers/input/joystick/sidewinder.c:727:29: warning: '/input' directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]

Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
---
 drivers/input/joystick/sidewinder.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
index 7f37d18c8..2bd5cfe5c 100644
--- a/drivers/input/joystick/sidewinder.c
+++ b/drivers/input/joystick/sidewinder.c
@@ -97,7 +97,7 @@ struct sw {
 	struct gameport *gameport;
 	struct input_dev *dev[4];
 	char name[64];
-	char phys[4][32];
+	char phys[4][64];
 	int length;
 	int type;
 	int bits;
@@ -574,7 +574,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
 	unsigned char *buf = NULL;	/* [SW_LENGTH] */
 	unsigned char *idbuf = NULL;	/* [SW_LENGTH] */
 	unsigned char m = 1;
-	char comment[40];
+	char comment[48];
 
 	comment[0] = 0;
 
-- 
2.43.0

Re: [PATCH] Input: sidewinder - size the name buffers to their formats

[Dmitry Torokhov]

On Fri, Nov 06, 2026 at 11:33:00AM +0800, xujiahao wrote:
> sw_connect() composes the physical path of each port as "%s/input%d"
> from gameport->phys into a 32-byte array.  gameport->phys is a 32-byte
> string and the port number is an int, so the worst case is 31 + 6 + 10
> characters plus the terminator and does not fit.
> 
> sw_3dp_id() builds " [PnP %d.%02d id %s rev %s]" into the 40-byte
> comment buffer of sw_connect().  The PnP ID is 7 characters, the
> revision string 8, and the %d arguments are a full-range int as far as
> the compiler can tell, so 44 characters plus the terminator do not fit
> either.
> 
> Size both buffers to their formats.  Truncation is theoretical with the
> values seen today, but a buffer should not be smaller than what it is
> asked to hold.  Building with W=1:
> 
>   drivers/input/joystick/sidewinder.c:538:58: warning: '%s' directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
>   drivers/input/joystick/sidewinder.c:727:29: warning: '/input' directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]
> 
> Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
> ---
>  drivers/input/joystick/sidewinder.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
> index 7f37d18c8..2bd5cfe5c 100644
> --- a/drivers/input/joystick/sidewinder.c
> +++ b/drivers/input/joystick/sidewinder.c
> @@ -97,7 +97,7 @@ struct sw {
>  	struct gameport *gameport;
>  	struct input_dev *dev[4];
>  	char name[64];
> -	char phys[4][32];
> +	char phys[4][64];
>  	int length;
>  	int type;
>  	int bits;
> @@ -574,7 +574,7 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
>  	unsigned char *buf = NULL;	/* [SW_LENGTH] */
>  	unsigned char *idbuf = NULL;	/* [SW_LENGTH] */
>  	unsigned char m = 1;
> -	char comment[40];
> +	char comment[48];

This just wastes memory for something that never happens. We are OK even
if data is truncated.

To shut off the warnings I think we can switch to scnprintf().

Thanks.

-- 
Dmitry

[PATCH v2] Input: sidewinder - use scnprintf() for the port names

[xujiahao]

sw_connect() composes the physical path of each port as "%s/input%d"
from gameport->phys into a 32-byte array, and sw_3dp_id() builds
" [PnP %d.%02d id %s rev %s]" into the 40-byte comment buffer of
sw_connect().  GCC reports that both formats can overflow their buffers
in a W=1 build:

  drivers/input/joystick/sidewinder.c:538:58: warning: ‘%s’ directive output may be truncated writing up to 8 bytes into a region of size between 5 and 21 [-Wformat-truncation=]
  drivers/input/joystick/sidewinder.c:727:29: warning: ‘/input’ directive output may be truncated writing 6 bytes into a region of size between 1 and 32 [-Wformat-truncation=]

The values seen in practice fit these buffers, and a truncated name is
harmless, so keep the sizes as they are and switch to scnprintf() to
make the truncation explicit instead of letting the compiler warn about
a possible one.

Link: https://lore.kernel.org/all/20261106033300.3439313-1-xujiahao@cmss.chinamobile.com/
Suggested-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
---
 drivers/input/joystick/sidewinder.c | 16 ++++++++--------
 1 file changed, 8 insertions(+), 8 deletions(-)

diff --git a/drivers/input/joystick/sidewinder.c b/drivers/input/joystick/sidewinder.c
index 7f37d18c8..bca81df19 100644
--- a/drivers/input/joystick/sidewinder.c
+++ b/drivers/input/joystick/sidewinder.c
@@ -535,12 +535,12 @@ static void sw_3dp_id(unsigned char *buf, char *comment, size_t size)
 
 	pnp[7] = rev[8] = 0;
 
-	snprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
-		(int) ((sw_get_bits(buf, 8, 6, 1) << 6) |		/* Two 6-bit values */
-			sw_get_bits(buf, 16, 6, 1)) / 100,
-		(int) ((sw_get_bits(buf, 8, 6, 1) << 6) |
-			sw_get_bits(buf, 16, 6, 1)) % 100,
-		 pnp, rev);
+	scnprintf(comment, size, " [PnP %d.%02d id %s rev %s]",
+		  (int)(((sw_get_bits(buf, 8, 6, 1) << 6) |	/* Two 6-bit values */
+			  sw_get_bits(buf, 16, 6, 1)) / 100),
+		  (int)(((sw_get_bits(buf, 8, 6, 1) << 6) |
+			  sw_get_bits(buf, 16, 6, 1)) % 100),
+		  pnp, rev);
 }
 
 /*
@@ -723,8 +723,8 @@ static int sw_connect(struct gameport *gameport, struct gameport_driver *drv)
 
 		snprintf(sw->name, sizeof(sw->name),
 			 "Microsoft SideWinder %s", sw_name[sw->type]);
-		snprintf(sw->phys[i], sizeof(sw->phys[i]),
-			 "%s/input%d", gameport->phys, i);
+		scnprintf(sw->phys[i], sizeof(sw->phys[i]),
+			  "%s/input%d", gameport->phys, i);
 
 		sw->dev[i] = input_dev = input_allocate_device();
 		if (!input_dev) {
-- 
2.43.0