rdma: Limit copy data by the destination size

The strncat() function will copy upto n bytes supplied as third
argument. The n bytes shouldn't be no more than destination and
not the source.

This change fixes the following clang compilation warnings:

res-srq.c:75:25: warning: size argument in 'strncat' call appears to be size of the source [-Wstrncat-size]
                        strncat(qp_str, tmp, sizeof(tmp) - 1);
                                             ^~~~~~~~~~~~~~~
res-srq.c:99:23: warning: size argument in 'strncat' call appears to be size of the source [-Wstrncat-size]
        strncat(qp_str, tmp, sizeof(tmp) - 1);
                             ^~~~~~~~~~~~~~~
res-srq.c:142:25: warning: size argument in 'strncat' call appears to be size of the source [-Wstrncat-size]
                        strncat(qp_str, tmp, sizeof(tmp) - 1);
                                             ^~~~~~~~~~~~~~~

Fixes: 9b272e138d23 ("rdma: Add SRQ resource tracking information")
Reported-by: Stephen Hemminger <stephen@networkplumber.org>
Signed-off-by: Leon Romanovsky <leonro@nvidia.com>
Signed-off-by: David Ahern <dsahern@kernel.org>

diff --git a/rdma/res-srq.c b/rdma/res-srq.c
index 5d8f384298b3e2b6123d3e1ff7e964448c17ded3..3038c3522671fbcf4a29784c2e7f5cfcca572d31 100644 (file)
--- a/rdma/res-srq.c
+++ b/rdma/res-srq.c
@@ -70,9 +70,8 @@ static int filter_srq_range_qps(struct rd *rd, struct nlattr **qp_line,
                                         *delimiter, tmp_min_range,
                                         tmp_max_range);
 
-                       if (strlen(qp_str) + strlen(tmp) >= MAX_QP_STR_LEN)
-                               return -EINVAL;
-                       strncat(qp_str, tmp, sizeof(tmp) - 1);
+                       strncat(qp_str, tmp,
+                               MAX_QP_STR_LEN - strlen(qp_str) - 1);
 
                        memset(tmp, 0, strlen(tmp));
                        *delimiter = ",";
@@ -94,9 +93,7 @@ static int filter_srq_range_qps(struct rd *rd, struct nlattr **qp_line,
                snprintf(tmp, sizeof(tmp), "%s%d-%d", *delimiter,
                         tmp_min_range, tmp_max_range);
 
-       if (strlen(qp_str) + strlen(tmp) >= MAX_QP_STR_LEN)
-               return -EINVAL;
-       strncat(qp_str, tmp, sizeof(tmp) - 1);
+       strncat(qp_str, tmp, MAX_QP_STR_LEN - strlen(qp_str) - 1);
        *delimiter = ",";
        return 0;
 }
@@ -137,9 +134,8 @@ static int get_srq_qps(struct rd *rd, struct nlattr *qp_table,  char *qp_str)
                                        qp_line[RDMA_NLDEV_ATTR_RES_LQPN]))
                                continue;
                        snprintf(tmp, sizeof(tmp), "%s%d", delimiter, qpn);
-                       if (strlen(qp_str) + strlen(tmp) >= MAX_QP_STR_LEN)
-                               goto out;
-                       strncat(qp_str, tmp, sizeof(tmp) - 1);
+                       strncat(qp_str, tmp,
+                               MAX_QP_STR_LEN - strlen(qp_str) - 1);
                        delimiter = ",";
                } else if (qp_line[RDMA_NLDEV_ATTR_MIN_RANGE] &&
                           qp_line[RDMA_NLDEV_ATTR_MAX_RANGE]) {