[PATCH] net: hns3: bound debugfs queue-name sprintf with scnprintf

[Haoran Wang]

hns3_dbg_bd_file_init() builds one debugfs file name per queue with an
unbounded sprintf into a stack buffer.

    char name[HNS3_DBG_FILE_NAME_LEN];
    sprintf(name, "%s%u", hns3_dbg_cmd[cmd].name, i);

The only two table entries that reach this sprintf use the 11-char prefixes
"tx_bd_queue" and "rx_bd_queue".  i is a u16 loop index bounded by
max_queue_num = hns3_get_max_available_channels(handle), a
firmware-reported u16 with no kernel-side clamp on either the PF path
(le16 tqp_num, ext_tqp_num, pf_rss_size_max from the hclge config
command) or the VF mailbox path.  When firmware reports >= 10000
queues, i reaches five decimal digits and the write becomes

    11 (prefix) + 5 (digits) + 1 (NUL) = 17 > 16

so the NUL terminator lands one byte past the 16-byte stack buffer.

Replace sprintf with scnprintf(name, sizeof(name), ...) so the write is
bounded, guarding against a potential overflow.  Queue counts below
10000 are unaffected (no truncation); in the firmware-misreport case
the name is truncated instead of corrupting the stack.

Signed-off-by: Haoran Wang <haoranwangsec@xxxxxxxxx>
---
 drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
index 1347edac7..e186ec940 100644
--- a/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
+++ b/drivers/net/ethernet/hisilicon/hns3/hns3_debugfs.c
@@ -860,7 +860,7 @@ static int hns3_dbg_bd_file_init(struct hnae3_handle *handle, u32 cmd)
 		data[i].handle = handle;
 		data[i].cmd = hns3_dbg_cmd[cmd].cmd;
 		data[i].qid = i;
-		sprintf(name, "%s%u", hns3_dbg_cmd[cmd].name, i);
+		scnprintf(name, sizeof(name), "%s%u", hns3_dbg_cmd[cmd].name, i);
 		debugfs_create_file(name, 0400, entry_dir, &data[i],
 				    &hns3_dbg_bd_info_fops);
 	}