On Wed, 12 Mar 2025 13:05:36 -0700
Kees Cook <kees@xxxxxxxxxx> wrote:
> When a character array without a terminating NUL character has a static
> initializer, GCC 15's -Wunterminated-string-initialization will only
> warn if the array lacks the "nonstring" attribute[1]. There is no reason
> for the command lookup logic to not use strcmp(), so grow the string
> length and update the check to eliminate the warning:
>
> ../drivers/scsi/pm8001/pm8001_ctl.c:652:7: warning: initializer-string for array of 'unsigned char' truncates NUL terminator but destination lacks 'nonstring' attribute (9 chars into 8 available) [-Wunterminated-string-initialization]
> 652 | {"set_nvmd", FLASH_CMD_SET_NVMD},
> | ^~~~~~~~~~
>
Did you look at the code just before it?
It is horrid beyond belief.
The function parameters include 'buf' and 'count'.
There is no real indication buf[] is '\0' terminated, but it does:
cmd_ptr = kcalloc(count, 2, GFP_KERNEL);
if (!cmd_ptr) {
pm8001_ha->fw_status = FAIL_OUT_MEMORY;
return -ENOMEM;
}
filename_ptr = cmd_ptr + count;
res = sscanf(buf, "%s %s", cmd_ptr, filename_ptr);
The search loop is then using cmd_ptr.
It only needs to find the separating ' ', no need to copy anything.
> Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=117178 [1]
> Signed-off-by: Kees Cook <kees@xxxxxxxxxx>
> ---
> In taking another look at this, I realize that actually strcmp() should be used,
> so just grow the size of this character array and use strcmp().
> v1: https://lore.kernel.org/lkml/20250310222553.work.437-kees@xxxxxxxxxx/
> v2: Use strcmp()
> ---
> Cc: Jack Wang <jinpu.wang@xxxxxxxxxxxxxxx>
> Cc: "James E.J. Bottomley" <James.Bottomley@xxxxxxxxxxxxxxxxxxxxx>
> Cc: "Martin K. Petersen" <martin.petersen@xxxxxxxxxx>
> Cc: linux-scsi@xxxxxxxxxxxxxxx
> ---
> drivers/scsi/pm8001/pm8001_ctl.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/scsi/pm8001/pm8001_ctl.c b/drivers/scsi/pm8001/pm8001_ctl.c
> index 85ff95c6543a..bb8fd5f0f441 100644
> --- a/drivers/scsi/pm8001/pm8001_ctl.c
> +++ b/drivers/scsi/pm8001/pm8001_ctl.c
> @@ -644,7 +644,7 @@ static DEVICE_ATTR(gsm_log, S_IRUGO, pm8001_ctl_gsm_log_show, NULL);
> #define FLASH_CMD_SET_NVMD 0x02
>
> struct flash_command {
> - u8 command[8];
> + u8 command[9];
> int code;
'code' can only be 0/1/2 - so could be u8 to remove the padding.
> };
>
> @@ -825,8 +825,7 @@ static ssize_t pm8001_store_update_fw(struct device *cdev,
> }
>
> for (i = 0; flash_command_table[i].code != FLASH_CMD_NONE; i++) {
> - if (!memcmp(flash_command_table[i].command,
> - cmd_ptr, strlen(cmd_ptr))) {
> + if (!strcmp(flash_command_table[i].command, cmd_ptr)) {
> flash_command = flash_command_table[i].code;
This looks like a API change since an unique initial portion used to
be enough. the strcmp() requires a full match.
David
> break;
> }
