Thread (12 messages) 12 messages, 4 authors, 2026-06-16
COLD39d

[PATCH v3 1/2] eal: fix off by one in in tailq name init

From: Stephen Hemminger <stephen@networkplumber.org>
Date: 2026-06-09 15:54:31
Subsystem: library code, the rest · Maintainers: Andrew Morton, Linus Torvalds

The tailq name is defined as 32 bytes, but name would be
silently truncated at 31 bytes. The function strlcpy() size
already accounts for the nul character at the end.


Fixes: f9acaf84e923 ("replace snprintf with strlcpy without adding extra include")
Cc: stable@dpdk.org

Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
---
Exposed by automated review of next patch.

 lib/eal/common/eal_common_tailqs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/lib/eal/common/eal_common_tailqs.c b/lib/eal/common/eal_common_tailqs.c
index c581f43b6f..fe3ced21c7 100644
--- a/lib/eal/common/eal_common_tailqs.c
+++ b/lib/eal/common/eal_common_tailqs.c
@@ -83,7 +83,7 @@ rte_eal_tailq_create(const char *name)
 
 		mcfg = rte_eal_get_configuration()->mem_config;
 		head = &mcfg->tailq_head[rte_tailqs_count];
-		strlcpy(head->name, name, sizeof(head->name) - 1);
+		strlcpy(head->name, name, sizeof(head->name));
 		TAILQ_INIT(&head->tailq_head);
 		rte_tailqs_count++;
 	}
-- 
2.53.0
Keyboard shortcuts
hback out one level
jnext message in thread
kprevious message in thread
ldrill in
Escclose help / fold thread tree
?toggle this help