Commit c9741a03 authored by Alexey Kodanev's avatar Alexey Kodanev Committed by David S. Miller

bna: adjust 'name' buf size of bna_tcb and bna_ccb structures

To have enough space to write all possible sprintf() args. Currently
'name' size is 16, but the first '%s' specifier may already need at
least 16 characters, since 'bnad->netdev->name' is used there.

For '%d' specifiers, assume that they require:
 * 1 char for 'tx_id + tx_info->tcb[i]->id' sum, BNAD_MAX_TXQ_PER_TX is 8
 * 2 chars for 'rx_id + rx_info->rx_ctrl[i].ccb->id', BNAD_MAX_RXP_PER_RX
   is 16

And replace sprintf with snprintf.

Detected using the static analysis tool - Svace.

Fixes: 8b230ed8 ("bna: Brocade 10Gb Ethernet device driver")
Signed-off-by: default avatarAlexey Kodanev <aleksei.kodanev@bell-sw.com>
Reviewed-by: default avatarSimon Horman <horms@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 80ab5445
...@@ -416,7 +416,7 @@ struct bna_ib { ...@@ -416,7 +416,7 @@ struct bna_ib {
/* Tx object */ /* Tx object */
/* Tx datapath control structure */ /* Tx datapath control structure */
#define BNA_Q_NAME_SIZE 16 #define BNA_Q_NAME_SIZE (IFNAMSIZ + 6)
struct bna_tcb { struct bna_tcb {
/* Fast path */ /* Fast path */
void **sw_qpt; void **sw_qpt;
......
...@@ -1534,8 +1534,9 @@ bnad_tx_msix_register(struct bnad *bnad, struct bnad_tx_info *tx_info, ...@@ -1534,8 +1534,9 @@ bnad_tx_msix_register(struct bnad *bnad, struct bnad_tx_info *tx_info,
for (i = 0; i < num_txqs; i++) { for (i = 0; i < num_txqs; i++) {
vector_num = tx_info->tcb[i]->intr_vector; vector_num = tx_info->tcb[i]->intr_vector;
sprintf(tx_info->tcb[i]->name, "%s TXQ %d", bnad->netdev->name, snprintf(tx_info->tcb[i]->name, BNA_Q_NAME_SIZE, "%s TXQ %d",
tx_id + tx_info->tcb[i]->id); bnad->netdev->name,
tx_id + tx_info->tcb[i]->id);
err = request_irq(bnad->msix_table[vector_num].vector, err = request_irq(bnad->msix_table[vector_num].vector,
(irq_handler_t)bnad_msix_tx, 0, (irq_handler_t)bnad_msix_tx, 0,
tx_info->tcb[i]->name, tx_info->tcb[i]->name,
...@@ -1585,9 +1586,9 @@ bnad_rx_msix_register(struct bnad *bnad, struct bnad_rx_info *rx_info, ...@@ -1585,9 +1586,9 @@ bnad_rx_msix_register(struct bnad *bnad, struct bnad_rx_info *rx_info,
for (i = 0; i < num_rxps; i++) { for (i = 0; i < num_rxps; i++) {
vector_num = rx_info->rx_ctrl[i].ccb->intr_vector; vector_num = rx_info->rx_ctrl[i].ccb->intr_vector;
sprintf(rx_info->rx_ctrl[i].ccb->name, "%s CQ %d", snprintf(rx_info->rx_ctrl[i].ccb->name, BNA_Q_NAME_SIZE,
bnad->netdev->name, "%s CQ %d", bnad->netdev->name,
rx_id + rx_info->rx_ctrl[i].ccb->id); rx_id + rx_info->rx_ctrl[i].ccb->id);
err = request_irq(bnad->msix_table[vector_num].vector, err = request_irq(bnad->msix_table[vector_num].vector,
(irq_handler_t)bnad_msix_rx, 0, (irq_handler_t)bnad_msix_rx, 0,
rx_info->rx_ctrl[i].ccb->name, rx_info->rx_ctrl[i].ccb->name,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment