Re: [linux-next:master 13015/13783] drivers/net/virtio_net.c:4340:35: error: '%u' directive writing between 1 and 10 bytes into a region of size 9

[Yujie Liu <yujie.liu@intel.com>]

Hi Yanjun,

On Fri, Jan 19, 2024 at 03:44:35PM +0800, Zhu Yanjun wrote:
> 
> 在 2024/1/19 4:36, kernel test robot 写道:
> > tree:   https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
> > head:   2863b714f3ad0a9686f2de1b779228ad8c7a8052
> > commit: e3fe8d28c67bf6c291e920c6d04fa22afa14e6e4 [13015/13783] virtio_net: Fix "‘%d’ directive writing between 1 and 11 bytes into a region of size 10" warnings
> > config: x86_64-sof-customedconfig-avs-defconfig (https://download.01.org/0day-ci/archive/20240119/202401190425.IGYMqCJW-lkp@intel.com/config)
> > compiler: gcc-7 (Ubuntu 7.5.0-6ubuntu2) 7.5.0
> 
> I can reproduce this problem in my local host.
> 
> It seems that this problem is related with gcc-7. In the same test
> environment, with gcc-7, this problem will occur. With gcc later than
> version 9, this problem will not occur.
> 
> And with u16, the range of %u should be [0, 65535]. Not the following:
> "
>    drivers/net/virtio_net.c:4141:27: note: directive argument in the range
> [0, 2147483647]
>       sprintf(vi->sq[i].name, "output.%u", i); "
> 
> And the size of name is 16. That is, the name string can contain 15 bytes
> characters.
> When the variable i is set to the maximum 65535, the string should be
> "output.65535". The size of the string is 12 + 1 = 13 bytes.
> The size of the name is greater than the maximum string "output.65535".
> 
> In short, from the above, this problem results from gcc-7. It is a problem
> with gcc-7. Based on my tests with gcc-9, gcc-13, this problem is fixed in
> later gcc versions.
> And the warning is a false warning to this commit.

Thanks for the detailed analysis. We will configure the bot to ignore
this specific "format-overflow" error under gcc-7 to avoid more false
reports.

Best Regards,
Yujie

> 
> Best Regards
> Zhu Yanjun
> 
> > reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240119/202401190425.IGYMqCJW-lkp@intel.com/reproduce)
> > 
> > If you fix the issue in a separate patch/commit (i.e. not just a new version of
> > the same patch/commit), kindly add following tags
> > | Reported-by: kernel test robot <lkp@intel.com>
> > | Closes: https://lore.kernel.org/oe-kbuild-all/202401190425.IGYMqCJW-lkp@intel.com/
> > 
> > All errors (new ones prefixed by >>):
> > 
> >     drivers/net/virtio_net.c: In function 'init_vqs':
> >     drivers/net/virtio_net.c:4339:36: error: 'sprintf' may write a terminating nul past the end of the destination [-Werror=format-overflow=]
> >        sprintf(vi->rq[i].name, "input.%u", i);
> >                                         ^
> >     drivers/net/virtio_net.c:4339:3: note: 'sprintf' output between 8 and 17 bytes into a destination of size 16
> >        sprintf(vi->rq[i].name, "input.%u", i);
> >        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> > > > drivers/net/virtio_net.c:4340:35: error: '%u' directive writing between 1 and 10 bytes into a region of size 9 [-Werror=format-overflow=]
> >        sprintf(vi->sq[i].name, "output.%u", i);
> >                                        ^~
> >     drivers/net/virtio_net.c:4340:27: note: directive argument in the range [0, 2147483647]
> >        sprintf(vi->sq[i].name, "output.%u", i);
> >                                ^~~~~~~~~~~
> >     drivers/net/virtio_net.c:4340:3: note: 'sprintf' output between 9 and 18 bytes into a destination of size 16
> >        sprintf(vi->sq[i].name, "output.%u", i);
> >        ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> >     cc1: all warnings being treated as errors
>