Patch "tsnep: Fix tsnep_request_irq() format-overflow warning" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tsnep: Fix tsnep_request_irq() format-overflow warning

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tsnep-fix-tsnep_request_irq-format-overflow-warning.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 15a816d580f3587b4d68e2bd7ddf46c8479be0b6
Author: Gerhard Engleder <gerhard@xxxxxxxxxxxxxxxxxxxxx>
Date:   Mon Oct 23 20:38:56 2023 +0200

    tsnep: Fix tsnep_request_irq() format-overflow warning
    
    [ Upstream commit 00e984cb986b31e9313745e51daceaa1e1eb7351 ]
    
    Compiler warns about a possible format-overflow in tsnep_request_irq():
    drivers/net/ethernet/engleder/tsnep_main.c:884:55: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=]
                             sprintf(queue->name, "%s-rx-%d", name,
                                                           ^
    drivers/net/ethernet/engleder/tsnep_main.c:881:55: warning: 'sprintf' may write a terminating nul past the end of the destination [-Wformat-overflow=]
                             sprintf(queue->name, "%s-tx-%d", name,
                                                           ^
    drivers/net/ethernet/engleder/tsnep_main.c:878:49: warning: '-txrx-' directive writing 6 bytes into a region of size between 5 and 25 [-Wformat-overflow=]
                             sprintf(queue->name, "%s-txrx-%d", name,
                                                     ^~~~~~
    
    Actually overflow cannot happen. Name is limited to IFNAMSIZ, because
    netdev_name() is called during ndo_open(). queue_index is single char,
    because less than 10 queues are supported.
    
    Fix warning with snprintf(). Additionally increase buffer to 32 bytes,
    because those 7 additional bytes were unused anyway.
    
    Reported-by: kernel test robot <lkp@xxxxxxxxx>
    Closes: https://lore.kernel.org/oe-kbuild-all/202310182028.vmDthIUa-lkp@xxxxxxxxx/
    Signed-off-by: Gerhard Engleder <gerhard@xxxxxxxxxxxxxxxxxxxxx>
    Reviewed-by: Jacob Keller <jacob.e.keller@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20231023183856.58373-1-gerhard@xxxxxxxxxxxxxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/engleder/tsnep.h b/drivers/net/ethernet/engleder/tsnep.h
index 6e14c918e3fb7..f188fba021a62 100644
--- a/drivers/net/ethernet/engleder/tsnep.h
+++ b/drivers/net/ethernet/engleder/tsnep.h
@@ -143,7 +143,7 @@ struct tsnep_rx {
 
 struct tsnep_queue {
 	struct tsnep_adapter *adapter;
-	char name[IFNAMSIZ + 9];
+	char name[IFNAMSIZ + 16];
 
 	struct tsnep_tx *tx;
 	struct tsnep_rx *rx;
diff --git a/drivers/net/ethernet/engleder/tsnep_main.c b/drivers/net/ethernet/engleder/tsnep_main.c
index 8b992dc9bb52b..38da2d6c250e6 100644
--- a/drivers/net/ethernet/engleder/tsnep_main.c
+++ b/drivers/net/ethernet/engleder/tsnep_main.c
@@ -1779,14 +1779,14 @@ static int tsnep_request_irq(struct tsnep_queue *queue, bool first)
 		dev = queue->adapter;
 	} else {
 		if (queue->tx && queue->rx)
-			sprintf(queue->name, "%s-txrx-%d", name,
-				queue->rx->queue_index);
+			snprintf(queue->name, sizeof(queue->name), "%s-txrx-%d",
+				 name, queue->rx->queue_index);
 		else if (queue->tx)
-			sprintf(queue->name, "%s-tx-%d", name,
-				queue->tx->queue_index);
+			snprintf(queue->name, sizeof(queue->name), "%s-tx-%d",
+				 name, queue->tx->queue_index);
 		else
-			sprintf(queue->name, "%s-rx-%d", name,
-				queue->rx->queue_index);
+			snprintf(queue->name, sizeof(queue->name), "%s-rx-%d",
+				 name, queue->rx->queue_index);
 		handler = tsnep_irq_txrx;
 		dev = queue;
 	}