The ring name is passed in as part of this drivers API, but it doesn't check that the name is not truncated.
Signed-off-by: Stephen Hemminger <step...@networkplumber.org> --- v2 - fix whitespace creep drivers/net/ring/rte_eth_ring.c | 17 +++++++++++++++-- 1 file changed, 15 insertions(+), 2 deletions(-) diff --git a/drivers/net/ring/rte_eth_ring.c b/drivers/net/ring/rte_eth_ring.c index 0355f2b7c4d8..979993fd3e11 100644 --- a/drivers/net/ring/rte_eth_ring.c +++ b/drivers/net/ring/rte_eth_ring.c @@ -383,7 +383,12 @@ rte_eth_from_rings(const char *name, struct rte_ring *const rx_queues[], snprintf(args_str, sizeof(args_str), "%s=%p", ETH_RING_INTERNAL_ARG, &args); - snprintf(ring_name, sizeof(ring_name), "net_ring_%s", name); + + ret = snprintf(ring_name, sizeof(ring_name), "net_ring_%s", name); + if (ret >= (int)sizeof(ring_name)) { + rte_errno = ENAMETOOLONG; + return -1; + } ret = rte_vdev_init(ring_name, args_str); if (ret) { @@ -417,7 +422,15 @@ eth_dev_ring_create(const char *name, const unsigned int numa_node, RTE_PMD_RING_MAX_TX_RINGS); for (i = 0; i < num_rings; i++) { - snprintf(rng_name, sizeof(rng_name), "ETH_RXTX%u_%s", i, name); + int cc; + + cc = snprintf(rng_name, sizeof(rng_name), + "ETH_RXTX%u_%s", i, name); + if (cc >= (int)sizeof(rng_name)) { + rte_errno = ENAMETOOLONG; + return -1; + } + rxtx[i] = (action == DEV_CREATE) ? rte_ring_create(rng_name, 1024, numa_node, RING_F_SP_ENQ|RING_F_SC_DEQ) : -- 2.20.1