[PATCH] pinctrl: mediatek: Use scnprintf() for avoiding potential buffer overflow

[PATCH] pinctrl: mediatek: Use scnprintf() for avoiding potential buffer overflow

[Takashi Iwai]

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 drivers/pinctrl/mediatek/pinctrl-paris.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
index 3ee8086f5e55..3853ec3a2a8e 100644
--- a/drivers/pinctrl/mediatek/pinctrl-paris.c
+++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
@@ -611,7 +611,7 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
 	} else if (pullen != MTK_DISABLE && pullen != MTK_ENABLE) {
 		pullen = 0;
 	}
-	len += snprintf(buf + len, bufLen - len,
+	len += scnprintf(buf + len, bufLen - len,
 			"%03d: %1d%1d%1d%1d%02d%1d%1d%1d%1d",
 			gpio,
 			pinmux,
@@ -625,10 +625,10 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
 			pullup);
 
 	if (r1 != -1) {
-		len += snprintf(buf + len, bufLen - len, " (%1d %1d)\n",
+		len += scnprintf(buf + len, bufLen - len, " (%1d %1d)\n",
 			r1, r0);
 	} else {
-		len += snprintf(buf + len, bufLen - len, "\n");
+		len += scnprintf(buf + len, bufLen - len, "\n");
 	}
 
 	return len;
-- 
2.16.4

Re: [PATCH] pinctrl: mediatek: Use scnprintf() for avoiding potential buffer overflow

[Takashi Iwai]

On Wed, 11 Mar 2020 10:06:44 +0100,
Takashi Iwai wrote:
> 
> Since snprintf() returns the would-be-output size instead of the
> actual output size, the succeeding calls may go beyond the given
> buffer limit.  Fix it by replacing with scnprintf().
> 
> Signed-off-by: Takashi Iwai <tiwai@suse.de>

A gentle reminder for this forgotten patch.
Let me know if any further change is needed.


thanks,

Takashi

> ---
>  drivers/pinctrl/mediatek/pinctrl-paris.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c
> index 3ee8086f5e55..3853ec3a2a8e 100644
> --- a/drivers/pinctrl/mediatek/pinctrl-paris.c
> +++ b/drivers/pinctrl/mediatek/pinctrl-paris.c
> @@ -611,7 +611,7 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
>  	} else if (pullen != MTK_DISABLE && pullen != MTK_ENABLE) {
>  		pullen = 0;
>  	}
> -	len += snprintf(buf + len, bufLen - len,
> +	len += scnprintf(buf + len, bufLen - len,
>  			"%03d: %1d%1d%1d%1d%02d%1d%1d%1d%1d",
>  			gpio,
>  			pinmux,
> @@ -625,10 +625,10 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw,
>  			pullup);
>  
>  	if (r1 != -1) {
> -		len += snprintf(buf + len, bufLen - len, " (%1d %1d)\n",
> +		len += scnprintf(buf + len, bufLen - len, " (%1d %1d)\n",
>  			r1, r0);
>  	} else {
> -		len += snprintf(buf + len, bufLen - len, "\n");
> +		len += scnprintf(buf + len, bufLen - len, "\n");
>  	}
>  
>  	return len;
> -- 
> 2.16.4
> 

Re: [PATCH] pinctrl: mediatek: Use scnprintf() for avoiding potential buffer overflow

[Linus Walleij]

On Wed, Mar 11, 2020 at 10:06 AM Takashi Iwai <tiwai@suse.de> wrote:

> Since snprintf() returns the would-be-output size instead of the
> actual output size, the succeeding calls may go beyond the given
> buffer limit.  Fix it by replacing with scnprintf().
>
> Signed-off-by: Takashi Iwai <tiwai@suse.de>

No reaction from maintainers so patch applied.

Yours,
Linus Walleij