<div dir="ltr"><div dir="ltr"> </div> <div class="gmail_quote gmail_quote_container"><div dir="ltr" class="gmail_attr">On Fri, Apr 17, 2026 at 12:57 AM Denis Lyulin <<a href="mailto:lyulin.2003@mail.ru">lyulin.2003@mail.ru</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">Some strings, primarily for memory zone names, could exceed their buffer of size 32 (RTE_MEMZONE_NAMESIZE), because PCI_PRI_FMT format string is not strictly limited in size. This commit adds bounds checking via using snprintf instead of sprintf. It also adds use of appropriate format specifiers, which take width of integers in account. Fixes: 02a95625fe9c ("net/bnxt: add flow stats in extended stats") Cc: <a href="mailto:somnath.kotur@broadcom.com" target="_blank">somnath.kotur@broadcom.com</a> Cc: <a href="mailto:stable@dpdk.org" target="_blank">stable@dpdk.org</a> Signed-off-by: Denis Lyulin <<a href="mailto:lyulin.2003@mail.ru" target="_blank">lyulin.2003@mail.ru</a>> </blockquote><div>Acked-by: Kishore Padmanabha <<a href="mailto:kishore.padmanabha@broadcom.com">kishore.padmanabha@broadcom.com</a>> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex"> --- drivers/net/bnxt/bnxt_ethdev.c | 34 +++++++++++++++++++--------------- drivers/net/bnxt/bnxt_hwrm.c | 16 +++++++++------- 2 files changed, 28 insertions(+), 22 deletions(-) diff --git a/drivers/net/bnxt/bnxt_ethdev.c b/drivers/net/bnxt/bnxt_ethdev.c index b677f9491d..bb02a2579b 100644 --- a/drivers/net/bnxt/bnxt_ethdev.c +++ b/drivers/net/bnxt/bnxt_ethdev.c @@ -652,8 +652,9 @@ static int bnxt_init_fc_ctx_mem(struct bnxt *bp) max_fc = bp->flow_stat->max_fc; - sprintf(type, "bnxt_rx_fc_in_" PCI_PRI_FMT, pdev->addr.domain, - pdev->addr.bus, pdev->addr.devid, pdev->addr.function); + snprintf(type, RTE_MEMZONE_NAMESIZE, "bnxt_rx_fc_in_" PCI_PRI_FMT, + pdev->addr.domain, pdev->addr.bus, + pdev->addr.devid, pdev->addr.function); /* 4 bytes for each counter-id */ rc = bnxt_alloc_ctx_mem_buf(bp, type, max_fc * 4, @@ -661,8 +662,9 @@ static int bnxt_init_fc_ctx_mem(struct bnxt *bp) if (rc) return rc; - sprintf(type, "bnxt_rx_fc_out_" PCI_PRI_FMT, pdev->addr.domain, - pdev->addr.bus, pdev->addr.devid, pdev->addr.function); + snprintf(type, RTE_MEMZONE_NAMESIZE, "bnxt_rx_fc_out_" PCI_PRI_FMT, + pdev->addr.domain, pdev->addr.bus, + pdev->addr.devid, pdev->addr.function); /* 16 bytes for each counter - 8 bytes pkt_count, 8 bytes byte_count */ rc = bnxt_alloc_ctx_mem_buf(bp, type, max_fc * 16, @@ -670,8 +672,9 @@ static int bnxt_init_fc_ctx_mem(struct bnxt *bp) if (rc) return rc; - sprintf(type, "bnxt_tx_fc_in_" PCI_PRI_FMT, pdev->addr.domain, - pdev->addr.bus, pdev->addr.devid, pdev->addr.function); + snprintf(type, RTE_MEMZONE_NAMESIZE, "bnxt_tx_fc_in_" PCI_PRI_FMT, + pdev->addr.domain, pdev->addr.bus, + pdev->addr.devid, pdev->addr.function); /* 4 bytes for each counter-id */ rc = bnxt_alloc_ctx_mem_buf(bp, type, max_fc * 4, @@ -679,8 +682,9 @@ static int bnxt_init_fc_ctx_mem(struct bnxt *bp) if (rc) return rc; - sprintf(type, "bnxt_tx_fc_out_" PCI_PRI_FMT, pdev->addr.domain, - pdev->addr.bus, pdev->addr.devid, pdev->addr.function); + snprintf(type, RTE_MEMZONE_NAMESIZE, "bnxt_tx_fc_out_" PCI_PRI_FMT, + pdev->addr.domain, pdev->addr.bus, + pdev->addr.devid, pdev->addr.function); /* 16 bytes for each counter - 8 bytes pkt_count, 8 bytes byte_count */ rc = bnxt_alloc_ctx_mem_buf(bp, type, max_fc * 16, @@ -3252,7 +3256,7 @@ bnxt_fw_version_get(struct rte_eth_dev *dev, char *fw_version, size_t fw_size) uint8_t fw_rsvd = bp->fw_ver & 0xff; int ret; - ret = snprintf(fw_version, fw_size, "%d.%d.%d.%d", + ret = snprintf(fw_version, fw_size, "%hhu.%hhu.%hhu.%hhu", fw_major, fw_minor, fw_updt, fw_rsvd); if (ret < 0) return -EINVAL; @@ -5199,13 +5203,13 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp, RTE_ALIGN_MUL_CEIL(mem_size, BNXT_PAGE_SIZE) / BNXT_PAGE_SIZE; rmem->page_size = BNXT_PAGE_SIZE; - snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_pg_arr%s_%x_%d", + snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_pg_arr%s_%hx_%hu", suffix, idx, bp->eth_dev->data->port_id); ctx_pg->ctx_pg_arr = rte_zmalloc(name, sizeof(void *) * rmem->nr_pages, 0); if (ctx_pg->ctx_pg_arr == NULL) return -ENOMEM; - snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_dma_arr%s_%x_%d", + snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_dma_arr%s_%hx_%hu", suffix, idx, bp->eth_dev->data->port_id); ctx_pg->ctx_dma_arr = rte_zmalloc(name, sizeof(rte_iova_t *) * rmem->nr_pages, 0); if (ctx_pg->ctx_dma_arr == NULL) @@ -5219,7 +5223,7 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp, if (rmem->nr_pages > 1) { snprintf(name, RTE_MEMZONE_NAMESIZE, - "bnxt_ctxpgtbl%s_%x_%d", + "bnxt_ctxpgtbl%s_%hx_%hu", suffix, idx, bp->eth_dev->data->port_id); name[RTE_MEMZONE_NAMESIZE - 1] = 0; mz = rte_memzone_lookup(name); @@ -5244,7 +5248,7 @@ static int bnxt_alloc_ctx_mem_blk(struct bnxt *bp, rmem->pg_tbl_mz = mz; } - snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_%s_%x_%d", + snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_%s_%hx_%hu", suffix, idx, bp->eth_dev->data->port_id); mz = rte_memzone_lookup(name); if (!mz) { @@ -5393,7 +5397,7 @@ int bnxt_alloc_ctx_pg_tbls(struct bnxt *bp) for (i = 0; i < w && rc == 0; i++) { char name[RTE_MEMZONE_NAMESIZE] = {0}; - sprintf(name, "_%d_%d", i, type); + snprintf(name, RTE_MEMZONE_NAMESIZE, "_%d_%hu", i, type); if (ctxm->entry_multiple) entries = bnxt_roundup(ctxm->max_entries, @@ -6977,7 +6981,7 @@ static int bnxt_rep_port_probe(struct rte_pci_device *pci_dev, } /* representor port net_bdf_port */ - snprintf(name, sizeof(name), "net_%s_representor_%d", + snprintf(name, sizeof(name), "net_%s_representor_%hu", pci_dev-><a href="http://device.name" rel="noreferrer" target="_blank">device.name</a>, eth_da->representor_ports[i]); if (rte_eth_dev_allocated(name) != NULL) { diff --git a/drivers/net/bnxt/bnxt_hwrm.c b/drivers/net/bnxt/bnxt_hwrm.c index 0c82935de9..5c51108b65 100644 --- a/drivers/net/bnxt/bnxt_hwrm.c +++ b/drivers/net/bnxt/bnxt_hwrm.c @@ -1693,7 +1693,8 @@ int bnxt_hwrm_ver_get(struct bnxt *bp, uint32_t timeout) (dev_caps_cfg & HWRM_VER_GET_OUTPUT_DEV_CAPS_CFG_SHORT_CMD_REQUIRED)) || bp->hwrm_max_ext_req_len > HWRM_MAX_REQ_LEN) { - sprintf(type, "bnxt_hwrm_short_" PCI_PRI_FMT, + snprintf(type, RTE_MEMZONE_NAMESIZE, + "bnxt_hwrm_short_" PCI_PRI_FMT, bp->pdev->addr.domain, bp->pdev->addr.bus, bp->pdev->addr.devid, bp->pdev->addr.function); @@ -3526,8 +3527,9 @@ int bnxt_alloc_hwrm_resources(struct bnxt *bp) struct rte_pci_device *pdev = bp->pdev; char type[RTE_MEMZONE_NAMESIZE]; - sprintf(type, "bnxt_hwrm_" PCI_PRI_FMT, pdev->addr.domain, - pdev->addr.bus, pdev->addr.devid, pdev->addr.function); + snprintf(type, RTE_MEMZONE_NAMESIZE, "bnxt_hwrm_" PCI_PRI_FMT, + pdev->addr.domain, pdev->addr.bus, + pdev->addr.devid, pdev->addr.function); bp->max_resp_len = BNXT_PAGE_SIZE; bp->hwrm_cmd_resp_addr = rte_malloc(type, bp->max_resp_len, 0); if (bp->hwrm_cmd_resp_addr == NULL) @@ -6573,7 +6575,7 @@ static int bnxt_alloc_all_ctx_pg_info(struct bnxt *bp) if (ctxm->instance_bmap) n = hweight32(ctxm->instance_bmap); - sprintf(name, "bnxt_ctx_pgmem_%d_%d", + snprintf(name, RTE_MEMZONE_NAMESIZE, "bnxt_ctx_pgmem_%hu_%hu", bp->eth_dev->data->port_id, type); ctxm->pg_info = rte_malloc(name, sizeof(*ctxm->pg_info) * n, RTE_CACHE_LINE_SIZE); @@ -7535,7 +7537,7 @@ int bnxt_hwrm_cfa_pair_exists(struct bnxt *bp, struct bnxt_representor *rep_bp) } HWRM_PREP(&req, HWRM_CFA_PAIR_INFO, BNXT_USE_CHIMP_MB); - snprintf(req.pair_name, sizeof(req.pair_name), "%svfr%d", + snprintf(req.pair_name, sizeof(req.pair_name), "%svfr%hu", bp->eth_dev->data->name, rep_bp->vf_id); req.flags = rte_cpu_to_le_32(HWRM_CFA_PAIR_INFO_INPUT_FLAGS_LOOKUP_TYPE); @@ -7564,7 +7566,7 @@ int bnxt_hwrm_cfa_pair_alloc(struct bnxt *bp, struct bnxt_representor *rep_bp) HWRM_PREP(&req, HWRM_CFA_PAIR_ALLOC, BNXT_USE_CHIMP_MB); req.pair_mode = HWRM_CFA_PAIR_FREE_INPUT_PAIR_MODE_REP2FN_TRUFLOW; - snprintf(req.pair_name, sizeof(req.pair_name), "%svfr%d", + snprintf(req.pair_name, sizeof(req.pair_name), "%svfr%hu", bp->eth_dev->data->name, rep_bp->vf_id); req.pf_b_id = rep_bp->parent_pf_idx; @@ -7609,7 +7611,7 @@ int bnxt_hwrm_cfa_pair_free(struct bnxt *bp, struct bnxt_representor *rep_bp) } HWRM_PREP(&req, HWRM_CFA_PAIR_FREE, BNXT_USE_CHIMP_MB); - snprintf(req.pair_name, sizeof(req.pair_name), "%svfr%d", + snprintf(req.pair_name, sizeof(req.pair_name), "%svfr%hu", bp->eth_dev->data->name, rep_bp->vf_id); req.pf_b_id = rep_bp->parent_pf_idx; req.pair_mode = HWRM_CFA_PAIR_FREE_INPUT_PAIR_MODE_REP2FN_TRUFLOW; -- 2.34.1 </blockquote></div></div>