tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master head: f2e8a57ee9036c7d5443382b6c3c09b51a92ec7e commit: 6a39e62abbafd1d58d1722f40c7d26ef379c6a2f lib: string.h: detect intra-object overflow in fortified string functions date: 3 years ago config: arm64-allmodconfig (https://download.01.org/0day-ci/archive/20231210/202312100355.lHoJPgKy-lkp@xxxxxxxxx/config) compiler: aarch64-linux-gcc (GCC) 13.2.0 reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20231210/202312100355.lHoJPgKy-lkp@xxxxxxxxx/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@xxxxxxxxx> | Closes: https://lore.kernel.org/oe-kbuild-all/202312100355.lHoJPgKy-lkp@xxxxxxxxx/ All warnings (new ones prefixed by >>): drivers/block/rnbd/rnbd-srv.c: In function 'process_msg_open.isra': >> drivers/block/rnbd/rnbd-srv.c:616:51: warning: '%s' directive output may be truncated writing up to 254 bytes into a region of size between 0 and 4095 [-Wformat-truncation=] 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~ In function 'rnbd_srv_get_full_path', inlined from 'process_msg_open.isra' at drivers/block/rnbd/rnbd-srv.c:721:14: drivers/block/rnbd/rnbd-srv.c:616:17: note: 'snprintf' output between 2 and 4351 bytes into a destination of size 4096 616 | snprintf(full_path, PATH_MAX, "%s/%s", | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 617 | dev_search_path, dev_name); | ~~~~~~~~~~~~~~~~~~~~~~~~~~ vim +616 drivers/block/rnbd/rnbd-srv.c 2de6c8de192b934 Jack Wang 2020-05-11 588 2de6c8de192b934 Jack Wang 2020-05-11 589 static char *rnbd_srv_get_full_path(struct rnbd_srv_session *srv_sess, 2de6c8de192b934 Jack Wang 2020-05-11 590 const char *dev_name) 2de6c8de192b934 Jack Wang 2020-05-11 591 { 2de6c8de192b934 Jack Wang 2020-05-11 592 char *full_path; 2de6c8de192b934 Jack Wang 2020-05-11 593 char *a, *b; 2de6c8de192b934 Jack Wang 2020-05-11 594 2de6c8de192b934 Jack Wang 2020-05-11 595 full_path = kmalloc(PATH_MAX, GFP_KERNEL); 2de6c8de192b934 Jack Wang 2020-05-11 596 if (!full_path) 2de6c8de192b934 Jack Wang 2020-05-11 597 return ERR_PTR(-ENOMEM); 2de6c8de192b934 Jack Wang 2020-05-11 598 2de6c8de192b934 Jack Wang 2020-05-11 599 /* 2de6c8de192b934 Jack Wang 2020-05-11 600 * Replace %SESSNAME% with a real session name in order to 2de6c8de192b934 Jack Wang 2020-05-11 601 * create device namespace. 2de6c8de192b934 Jack Wang 2020-05-11 602 */ 2de6c8de192b934 Jack Wang 2020-05-11 603 a = strnstr(dev_search_path, "%SESSNAME%", sizeof(dev_search_path)); 2de6c8de192b934 Jack Wang 2020-05-11 604 if (a) { 2de6c8de192b934 Jack Wang 2020-05-11 605 int len = a - dev_search_path; 2de6c8de192b934 Jack Wang 2020-05-11 606 2de6c8de192b934 Jack Wang 2020-05-11 607 len = snprintf(full_path, PATH_MAX, "%.*s/%s/%s", len, 2de6c8de192b934 Jack Wang 2020-05-11 608 dev_search_path, srv_sess->sessname, dev_name); 2de6c8de192b934 Jack Wang 2020-05-11 609 if (len >= PATH_MAX) { 2de6c8de192b934 Jack Wang 2020-05-11 610 pr_err("Too long path: %s, %s, %s\n", 2de6c8de192b934 Jack Wang 2020-05-11 611 dev_search_path, srv_sess->sessname, dev_name); 2de6c8de192b934 Jack Wang 2020-05-11 612 kfree(full_path); 2de6c8de192b934 Jack Wang 2020-05-11 613 return ERR_PTR(-EINVAL); 2de6c8de192b934 Jack Wang 2020-05-11 614 } 2de6c8de192b934 Jack Wang 2020-05-11 615 } else { 2de6c8de192b934 Jack Wang 2020-05-11 @616 snprintf(full_path, PATH_MAX, "%s/%s", 2de6c8de192b934 Jack Wang 2020-05-11 617 dev_search_path, dev_name); 2de6c8de192b934 Jack Wang 2020-05-11 618 } 2de6c8de192b934 Jack Wang 2020-05-11 619 2de6c8de192b934 Jack Wang 2020-05-11 620 /* eliminitate duplicated slashes */ 2de6c8de192b934 Jack Wang 2020-05-11 621 a = strchr(full_path, '/'); 2de6c8de192b934 Jack Wang 2020-05-11 622 b = a; 2de6c8de192b934 Jack Wang 2020-05-11 623 while (*b != '\0') { 2de6c8de192b934 Jack Wang 2020-05-11 624 if (*b == '/' && *a == '/') { 2de6c8de192b934 Jack Wang 2020-05-11 625 b++; 2de6c8de192b934 Jack Wang 2020-05-11 626 } else { 2de6c8de192b934 Jack Wang 2020-05-11 627 a++; 2de6c8de192b934 Jack Wang 2020-05-11 628 *a = *b; 2de6c8de192b934 Jack Wang 2020-05-11 629 b++; 2de6c8de192b934 Jack Wang 2020-05-11 630 } 2de6c8de192b934 Jack Wang 2020-05-11 631 } 2de6c8de192b934 Jack Wang 2020-05-11 632 a++; 2de6c8de192b934 Jack Wang 2020-05-11 633 *a = '\0'; 2de6c8de192b934 Jack Wang 2020-05-11 634 2de6c8de192b934 Jack Wang 2020-05-11 635 return full_path; 2de6c8de192b934 Jack Wang 2020-05-11 636 } 2de6c8de192b934 Jack Wang 2020-05-11 637 :::::: The code at line 616 was first introduced by commit :::::: 2de6c8de192b9341ffa5e84afe1ce6196d4eef41 block/rnbd: server: main functionality :::::: TO: Jack Wang <jinpu.wang@xxxxxxxxxxxxxxx> :::::: CC: Jason Gunthorpe <jgg@xxxxxxxxxxxx> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
