Commit 413ae546 authored by Takashi Iwai's avatar Takashi Iwai Committed by David S. Miller

net: nfp: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().
Reviewed-by: default avatarSimon Horman <simon.horman@netronome.com>
Cc: "David S . Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: oss-drivers@netronome.com
To: netdev@vger.kernel.org
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4a348601
...@@ -616,7 +616,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface) ...@@ -616,7 +616,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
if (bar->iomem) { if (bar->iomem) {
int pf; int pf;
msg += snprintf(msg, end - msg, "0.0: General/MSI-X SRAM, "); msg += scnprintf(msg, end - msg, "0.0: General/MSI-X SRAM, ");
atomic_inc(&bar->refcnt); atomic_inc(&bar->refcnt);
bars_free--; bars_free--;
...@@ -661,7 +661,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface) ...@@ -661,7 +661,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
/* Configure, and lock, BAR0.1 for PCIe XPB (MSI-X PBA) */ /* Configure, and lock, BAR0.1 for PCIe XPB (MSI-X PBA) */
bar = &nfp->bar[1]; bar = &nfp->bar[1];
msg += snprintf(msg, end - msg, "0.1: PCIe XPB/MSI-X PBA, "); msg += scnprintf(msg, end - msg, "0.1: PCIe XPB/MSI-X PBA, ");
atomic_inc(&bar->refcnt); atomic_inc(&bar->refcnt);
bars_free--; bars_free--;
...@@ -680,8 +680,8 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface) ...@@ -680,8 +680,8 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
bar->iomem = ioremap(nfp_bar_resource_start(bar), bar->iomem = ioremap(nfp_bar_resource_start(bar),
nfp_bar_resource_len(bar)); nfp_bar_resource_len(bar));
if (bar->iomem) { if (bar->iomem) {
msg += snprintf(msg, end - msg, msg += scnprintf(msg, end - msg,
"0.%d: Explicit%d, ", 4 + i, i); "0.%d: Explicit%d, ", 4 + i, i);
atomic_inc(&bar->refcnt); atomic_inc(&bar->refcnt);
bars_free--; bars_free--;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment