[PATCH] scsi: st: Avoid truncating the tape name for large tape numbers

[xujiahao]

create_one_cdev() builds the class device name in a 10-byte buffer as
"n" (no-rewind devices) + tape->name + a one-character mode suffix.
tape->name is a DISK_NAME_LEN (32) byte array holding "st%d", and the
tape index comes from an idr with an upper bound of ST_MAX_TAPES - 1
(131071, six digits), so "n" + "st131071" + suffix + terminator needs
11 bytes.  Names of tapes with large index numbers are truncated today
and lose the mode suffix, which leaves the rewind modes of such a tape
with the same name.

Size the buffer after the actual requirement, DISK_NAME_LEN + 2, and
pass sizeof(name) to snprintf() so the two cannot drift apart again.

GCC reports with -Wformat-truncation=2:

  drivers/scsi/st.c:4393:31: warning: '%s' directive output may be truncated writing up to 31 bytes into a region of size between 9 and 10 [-Wformat-truncation=]

Signed-off-by: xujiahao <xujiahao@xxxxxxxxxxxxxxxxxxxx>
---
 drivers/scsi/st.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/st.c b/drivers/scsi/st.c
index e9d41e3cc..311781987 100644
--- a/drivers/scsi/st.c
+++ b/drivers/scsi/st.c
@@ -4366,7 +4366,7 @@ static int create_one_cdev(struct scsi_tape *tape, int mode, int rew)
 	struct cdev *cdev;
 	struct device *dev;
 	struct st_modedef *STm = &(tape->modes[mode]);
-	char name[10];
+	char name[DISK_NAME_LEN + 2];
 	int dev_num = tape->index;
 
 	cdev_devno = MKDEV(SCSI_TAPE_MAJOR, TAPE_MINOR(dev_num, mode, rew));
@@ -4390,7 +4390,7 @@ static int create_one_cdev(struct scsi_tape *tape, int mode, int rew)
 	}
 
 	i = mode << (4 - ST_NBR_MODE_BITS);
-	snprintf(name, 10, "%s%s%s", rew ? "n" : "",
+	snprintf(name, sizeof(name), "%s%s%s", rew ? "n" : "",
 		 tape->name, st_formats[i]);
 
 	dev = device_create(&st_sysfs_class, &tape->device->sdev_gendev,
-- 
2.43.0