All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Maciej W. Rozycki" <macro@orcam.me.uk>
To: Khalid Aziz <khalid@gonehiking.org>,
	"James E.J. Bottomley" <jejb@linux.ibm.com>,
	"Martin K. Petersen" <martin.petersen@oracle.com>
Cc: Christoph Hellwig <hch@lst.de>,
	linux-scsi@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 2/5] scsi: BusLogic: Avoid unbounded `vsprintf' use
Date: Thu, 15 Apr 2021 00:39:12 +0200 (CEST)	[thread overview]
Message-ID: <alpine.DEB.2.21.2104141521190.44318@angie.orcam.me.uk> (raw)
In-Reply-To: <alpine.DEB.2.21.2104141244520.44318@angie.orcam.me.uk>

Existing `blogic_msg' invocations do not appear to overrun its internal 
buffer of a fixed length of 100, which would cause stack corruption, but 
it's easy to miss with possible further updates and a fix is cheap in 
performance terms, so limit the output produced into the buffer by using 
`vsnprintf' rather than `vsprintf'.

Signed-off-by: Maciej W. Rozycki <macro@orcam.me.uk>
---
 drivers/scsi/BusLogic.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

linux-buslogic-vsnprintf.diff
Index: linux-macro-ide/drivers/scsi/BusLogic.c
===================================================================
--- linux-macro-ide.orig/drivers/scsi/BusLogic.c
+++ linux-macro-ide/drivers/scsi/BusLogic.c
@@ -3588,7 +3588,7 @@ static void blogic_msg(enum blogic_msgle
 	int len = 0;
 
 	va_start(args, adapter);
-	len = vsprintf(buf, fmt, args);
+	len = vsnprintf(buf, sizeof(buf), fmt, args);
 	va_end(args);
 	if (msglevel == BLOGIC_ANNOUNCE_LEVEL) {
 		static int msglines = 0;

  parent reply	other threads:[~2021-04-14 22:39 UTC|newest]

Thread overview: 30+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-04-14 22:38 [PATCH 0/5] Bring the BusLogic host bus adapter driver up to Y2021 Maciej W. Rozycki
2021-04-14 22:39 ` [PATCH 1/5] scsi: BusLogic: Fix missing `pr_cont' use Maciej W. Rozycki
2021-04-16  2:08   ` Joe Perches
2021-04-16 10:48     ` Maciej W. Rozycki
2021-04-16 14:02       ` Joe Perches
2021-04-16 14:28         ` Maciej W. Rozycki
2021-04-16 15:12           ` Joe Perches
2021-04-17 11:39       ` David Laight
2021-04-17 14:01         ` Maciej W. Rozycki
2021-04-16 20:41     ` Khalid Aziz
2021-04-17  0:09       ` Joe Perches
2021-04-16 19:34   ` Khalid Aziz
2021-04-14 22:39 ` Maciej W. Rozycki [this message]
2021-04-16 19:54   ` [PATCH 2/5] scsi: BusLogic: Avoid unbounded `vsprintf' use Khalid Aziz
2021-04-14 22:39 ` [PATCH 3/5] scsi: Provide for avoiding trailing allocation length with VPD inquiries Maciej W. Rozycki
2021-04-14 22:39 ` [PATCH 4/5] scsi: Avoid using reserved length byte " Maciej W. Rozycki
2021-04-14 22:39 ` [PATCH 5/5] scsi: Set allocation length to 255 for ATA Information VPD page Maciej W. Rozycki
2021-04-15 12:42   ` Nix
2021-04-16 15:18     ` Maciej W. Rozycki
2021-04-16 19:36 ` [PATCH 0/5] Bring the BusLogic host bus adapter driver up to Y2021 Khalid Aziz
2021-04-16 21:25   ` Maciej W. Rozycki
2021-04-18 20:21     ` Ondrej Zary
2021-04-19 15:06       ` Khalid Aziz
2021-04-19 16:01         ` Maciej W. Rozycki
2021-04-20  2:16           ` Khalid Aziz
2021-04-20 18:02             ` Maciej W. Rozycki
2021-04-22  2:36               ` Khalid Aziz
2021-04-22 16:27                 ` Maciej W. Rozycki
2021-04-22 18:07                   ` Khalid Aziz
2021-04-22 23:19                     ` Maciej W. Rozycki

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=alpine.DEB.2.21.2104141521190.44318@angie.orcam.me.uk \
    --to=macro@orcam.me.uk \
    --cc=hch@lst.de \
    --cc=jejb@linux.ibm.com \
    --cc=khalid@gonehiking.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-scsi@vger.kernel.org \
    --cc=martin.petersen@oracle.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.