Linux-Hwmon Archive on lore.kernel.org
 help / color / Atom feed
* Re: [PATCH] hwmon: (ibmpowernv) Use scnprintf() for avoiding potential buffer overflow
@ 2020-03-11 15:09 Guenter Roeck
  0 siblings, 0 replies; 2+ messages in thread
From: Guenter Roeck @ 2020-03-11 15:09 UTC (permalink / raw)
  To: Takashi Iwai; +Cc: Jean Delvare, linux-hwmon, linuxppc-dev

On Wed, Mar 11, 2020 at 08:39:44AM +0100, Takashi Iwai wrote:
> Since snprintf() returns the would-be-output size instead of the
> actual output size, the succeeding calls may go beyond the given
> buffer limit.  Fix it by replacing with scnprintf().
> 
> Signed-off-by: Takashi Iwai <tiwai@suse.de>

Applied to hwmon-next.

Thanks,
Guenter

> ---
>  drivers/hwmon/ibmpowernv.c | 8 ++++----
>  1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
> index 0e525cfbdfc5..a750647e66a4 100644
> --- a/drivers/hwmon/ibmpowernv.c
> +++ b/drivers/hwmon/ibmpowernv.c
> @@ -186,7 +186,7 @@ static void make_sensor_label(struct device_node *np,
>  	u32 id;
>  	size_t n;
>  
> -	n = snprintf(sdata->label, sizeof(sdata->label), "%s", label);
> +	n = scnprintf(sdata->label, sizeof(sdata->label), "%s", label);
>  
>  	/*
>  	 * Core temp pretty print
> @@ -199,11 +199,11 @@ static void make_sensor_label(struct device_node *np,
>  			 * The digital thermal sensors are associated
>  			 * with a core.
>  			 */
> -			n += snprintf(sdata->label + n,
> +			n += scnprintf(sdata->label + n,
>  				      sizeof(sdata->label) - n, " %d",
>  				      cpuid);
>  		else
> -			n += snprintf(sdata->label + n,
> +			n += scnprintf(sdata->label + n,
>  				      sizeof(sdata->label) - n, " phy%d", id);
>  	}
>  
> @@ -211,7 +211,7 @@ static void make_sensor_label(struct device_node *np,
>  	 * Membuffer pretty print
>  	 */
>  	if (!of_property_read_u32(np, "ibm,chip-id", &id))
> -		n += snprintf(sdata->label + n, sizeof(sdata->label) - n,
> +		n += scnprintf(sdata->label + n, sizeof(sdata->label) - n,
>  			      " %d", id & 0xffff);
>  }
>  
> -- 
> 2.16.4
> 

^ permalink raw reply	[flat|nested] 2+ messages in thread

* [PATCH] hwmon: (ibmpowernv) Use scnprintf() for avoiding potential buffer overflow
@ 2020-03-11  7:39 Takashi Iwai
  0 siblings, 0 replies; 2+ messages in thread
From: Takashi Iwai @ 2020-03-11  7:39 UTC (permalink / raw)
  To: Jean Delvare, Guenter Roeck, linux-hwmon, linuxppc-dev

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
---
 drivers/hwmon/ibmpowernv.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
index 0e525cfbdfc5..a750647e66a4 100644
--- a/drivers/hwmon/ibmpowernv.c
+++ b/drivers/hwmon/ibmpowernv.c
@@ -186,7 +186,7 @@ static void make_sensor_label(struct device_node *np,
 	u32 id;
 	size_t n;
 
-	n = snprintf(sdata->label, sizeof(sdata->label), "%s", label);
+	n = scnprintf(sdata->label, sizeof(sdata->label), "%s", label);
 
 	/*
 	 * Core temp pretty print
@@ -199,11 +199,11 @@ static void make_sensor_label(struct device_node *np,
 			 * The digital thermal sensors are associated
 			 * with a core.
 			 */
-			n += snprintf(sdata->label + n,
+			n += scnprintf(sdata->label + n,
 				      sizeof(sdata->label) - n, " %d",
 				      cpuid);
 		else
-			n += snprintf(sdata->label + n,
+			n += scnprintf(sdata->label + n,
 				      sizeof(sdata->label) - n, " phy%d", id);
 	}
 
@@ -211,7 +211,7 @@ static void make_sensor_label(struct device_node *np,
 	 * Membuffer pretty print
 	 */
 	if (!of_property_read_u32(np, "ibm,chip-id", &id))
-		n += snprintf(sdata->label + n, sizeof(sdata->label) - n,
+		n += scnprintf(sdata->label + n, sizeof(sdata->label) - n,
 			      " %d", id & 0xffff);
 }
 
-- 
2.16.4


^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, back to index

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-03-11 15:09 [PATCH] hwmon: (ibmpowernv) Use scnprintf() for avoiding potential buffer overflow Guenter Roeck
  -- strict thread matches above, loose matches on Subject: below --
2020-03-11  7:39 Takashi Iwai

Linux-Hwmon Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-hwmon/0 linux-hwmon/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-hwmon linux-hwmon/ https://lore.kernel.org/linux-hwmon \
		linux-hwmon@vger.kernel.org
	public-inbox-index linux-hwmon

Example config snippet for mirrors

Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-hwmon


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git