LKML Archive on lore.kernel.org
help / color / mirror / Atom feed
* [PATCH] mailbox: bcm-pdc: Use scnprintf() for avoiding potential buffer overflow
@ 2020-03-11 7:45 Takashi Iwai
2020-03-19 15:59 ` Takashi Iwai
0 siblings, 1 reply; 2+ messages in thread
From: Takashi Iwai @ 2020-03-11 7:45 UTC (permalink / raw)
To: Jassi Brar; +Cc: linux-kernel
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit. Fix it by replacing with scnprintf().
Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
drivers/mailbox/bcm-pdc-mailbox.c | 20 ++++++++++----------
1 file changed, 10 insertions(+), 10 deletions(-)
diff --git a/drivers/mailbox/bcm-pdc-mailbox.c b/drivers/mailbox/bcm-pdc-mailbox.c
index fcb3b18a0678..c10a9318a4b7 100644
--- a/drivers/mailbox/bcm-pdc-mailbox.c
+++ b/drivers/mailbox/bcm-pdc-mailbox.c
@@ -436,33 +436,33 @@ static ssize_t pdc_debugfs_read(struct file *filp, char __user *ubuf,
pdcs = filp->private_data;
out_offset = 0;
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"SPU %u stats:\n", pdcs->pdc_idx);
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"PDC requests....................%u\n",
pdcs->pdc_requests);
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"PDC responses...................%u\n",
pdcs->pdc_replies);
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"Tx not done.....................%u\n",
pdcs->last_tx_not_done);
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"Tx ring full....................%u\n",
pdcs->tx_ring_full);
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"Rx ring full....................%u\n",
pdcs->rx_ring_full);
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"Tx desc write fail. Ring full...%u\n",
pdcs->txnobuf);
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"Rx desc write fail. Ring full...%u\n",
pdcs->rxnobuf);
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"Receive overflow................%u\n",
pdcs->rx_oflow);
- out_offset += snprintf(buf + out_offset, out_count - out_offset,
+ out_offset += scnprintf(buf + out_offset, out_count - out_offset,
"Num frags in rx ring............%u\n",
NRXDACTIVE(pdcs->rxin, pdcs->last_rx_curr,
pdcs->nrxpost));
--
2.16.4
^ permalink raw reply related [flat|nested] 2+ messages in thread
* Re: [PATCH] mailbox: bcm-pdc: Use scnprintf() for avoiding potential buffer overflow
2020-03-11 7:45 [PATCH] mailbox: bcm-pdc: Use scnprintf() for avoiding potential buffer overflow Takashi Iwai
@ 2020-03-19 15:59 ` Takashi Iwai
0 siblings, 0 replies; 2+ messages in thread
From: Takashi Iwai @ 2020-03-19 15:59 UTC (permalink / raw)
To: Jassi Brar; +Cc: linux-kernel
On Wed, 11 Mar 2020 08:45:13 +0100,
Takashi Iwai wrote:
>
> Since snprintf() returns the would-be-output size instead of the
> actual output size, the succeeding calls may go beyond the given
> buffer limit. Fix it by replacing with scnprintf().
>
> Signed-off-by: Takashi Iwai <tiwai@suse.de>
A gentle reminder for this forgotten patch.
Let me know if any further changes are needed.
thanks,
Takashi
> ---
> drivers/mailbox/bcm-pdc-mailbox.c | 20 ++++++++++----------
> 1 file changed, 10 insertions(+), 10 deletions(-)
>
> diff --git a/drivers/mailbox/bcm-pdc-mailbox.c b/drivers/mailbox/bcm-pdc-mailbox.c
> index fcb3b18a0678..c10a9318a4b7 100644
> --- a/drivers/mailbox/bcm-pdc-mailbox.c
> +++ b/drivers/mailbox/bcm-pdc-mailbox.c
> @@ -436,33 +436,33 @@ static ssize_t pdc_debugfs_read(struct file *filp, char __user *ubuf,
>
> pdcs = filp->private_data;
> out_offset = 0;
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "SPU %u stats:\n", pdcs->pdc_idx);
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "PDC requests....................%u\n",
> pdcs->pdc_requests);
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "PDC responses...................%u\n",
> pdcs->pdc_replies);
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "Tx not done.....................%u\n",
> pdcs->last_tx_not_done);
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "Tx ring full....................%u\n",
> pdcs->tx_ring_full);
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "Rx ring full....................%u\n",
> pdcs->rx_ring_full);
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "Tx desc write fail. Ring full...%u\n",
> pdcs->txnobuf);
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "Rx desc write fail. Ring full...%u\n",
> pdcs->rxnobuf);
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "Receive overflow................%u\n",
> pdcs->rx_oflow);
> - out_offset += snprintf(buf + out_offset, out_count - out_offset,
> + out_offset += scnprintf(buf + out_offset, out_count - out_offset,
> "Num frags in rx ring............%u\n",
> NRXDACTIVE(pdcs->rxin, pdcs->last_rx_curr,
> pdcs->nrxpost));
> --
> 2.16.4
>
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2020-03-19 15:59 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-11 7:45 [PATCH] mailbox: bcm-pdc: Use scnprintf() for avoiding potential buffer overflow Takashi Iwai
2020-03-19 15:59 ` Takashi Iwai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).