Re: [PATCH] net: hns3: bound debugfs queue-name sprintf with scnprintf

[Jijie Shao <shaojijie@huawei.com>]

on 2026/10/19 21:22, Haoran Wang wrote:
> hns3_dbg_bd_file_init() builds one debugfs file name per queue with an
> unbounded sprintf into a stack buffer.
>
>      char name[HNS3_DBG_FILE_NAME_LEN];
>      sprintf(name, "%s%u", hns3_dbg_cmd[cmd].name, i);
>
> The only two table entries that reach this sprintf use the 11-char prefixes
> "tx_bd_queue" and "rx_bd_queue".  i is a u16 loop index bounded by
> max_queue_num = hns3_get_max_available_channels(handle), a
> firmware-reported u16 with no kernel-side clamp on either the PF path
> (le16 tqp_num, ext_tqp_num, pf_rss_size_max from the hclge config
> command) or the VF mailbox path.  When firmware reports >= 10000
> queues, i reaches five decimal digits and the write becomes
>
>      11 (prefix) + 5 (digits) + 1 (NUL) = 17 > 16
>
> so the NUL terminator lands one byte past the 16-byte stack buffer.
>
> Replace sprintf with scnprintf(name, sizeof(name), ...) so the write is
> bounded, guarding against a potential overflow.  Queue counts below
> 10000 are unaffected (no truncation); in the firmware-misreport case
> the name is truncated instead of corrupting the stack.

Thank you for the report.
However, the number of queues on our hardware will not exceed 10000,
and the driver trusts the queue count reported by firmware.
So this issue is not practically possible.

Thanks,
Jijie Shao


>
> Signed-off-by: Haoran Wang <haoranwangsec@gmail.com>
> ---
>   drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c |    2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
> index 1347edac7..e186ec940 100644
> --- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
> +++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
> @@ -860,7 +860,7 @@ static int hns3_dbg_bd_file_init(struct hnae3_handle *handle, u32 cmd)
>   		data[i].handle = handle;
>   		data[i].cmd = hns3_dbg_cmd[cmd].cmd;
>   		data[i].qid = i;
> -		sprintf(name, "%s%u", hns3_dbg_cmd[cmd].name, i);
> +		scnprintf(name, sizeof(name), "%s%u", hns3_dbg_cmd[cmd].name, i);
>   		debugfs_create_file(name, 0400, entry_dir, &data[i],
>   				    &hns3_dbg_bd_info_fops);
>   	}