Skip to content

L
linux
Commit 13bde56c authored by Takashi Iwai's avatar Takashi Iwai Committed by David S. Miller
Browse files
Options

net: caif: Use scnprintf() for avoiding potential buffer overflow 

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: "David S . Miller" <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cb851c01
Hide whitespace changes
Inline Side-by-side
Showing with 36 additions and 36 deletions
drivers/net/caif/caif_spi.c
View file @ 13bde56c
...@@ -141,29 +141,29 @@ static ssize_t dbgfs_state(struct file *file, char __user *user_buf, ...@@ -141,29 +141,29 @@ static ssize_t dbgfs_state(struct file *file, char __user *user_buf,
return 0; return 0;
/* Print out debug information. */ /* Print out debug information. */
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"CAIF SPI debug information:\n"); "CAIF SPI debug information:\n");
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), FLAVOR); len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len), FLAVOR);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"STATE: %d\n", cfspi->dbg_state); "STATE: %d\n", cfspi->dbg_state);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Previous CMD: 0x%x\n", cfspi->pcmd); "Previous CMD: 0x%x\n", cfspi->pcmd);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Current CMD: 0x%x\n", cfspi->cmd); "Current CMD: 0x%x\n", cfspi->cmd);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Previous TX len: %d\n", cfspi->tx_ppck_len); "Previous TX len: %d\n", cfspi->tx_ppck_len);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Previous RX len: %d\n", cfspi->rx_ppck_len); "Previous RX len: %d\n", cfspi->rx_ppck_len);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Current TX len: %d\n", cfspi->tx_cpck_len); "Current TX len: %d\n", cfspi->tx_cpck_len);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Current RX len: %d\n", cfspi->rx_cpck_len); "Current RX len: %d\n", cfspi->rx_cpck_len);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Next TX len: %d\n", cfspi->tx_npck_len); "Next TX len: %d\n", cfspi->tx_npck_len);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Next RX len: %d\n", cfspi->rx_npck_len); "Next RX len: %d\n", cfspi->rx_npck_len);
if (len > DEBUGFS_BUF_SIZE) if (len > DEBUGFS_BUF_SIZE)
len = DEBUGFS_BUF_SIZE; len = DEBUGFS_BUF_SIZE;
...@@ -180,23 +180,23 @@ static ssize_t print_frame(char *buf, size_t size, char *frm, ...@@ -180,23 +180,23 @@ static ssize_t print_frame(char *buf, size_t size, char *frm,
int len = 0; int len = 0;
int i; int i;
for (i = 0; i < count; i++) { for (i = 0; i < count; i++) {
len += snprintf((buf + len), (size - len), len += scnprintf((buf + len), (size - len),
"[0x" BYTE_HEX_FMT "]", "[0x" BYTE_HEX_FMT "]",
frm[i]); frm[i]);
if ((i == cut) && (count > (cut * 2))) { if ((i == cut) && (count > (cut * 2))) {
/* Fast forward. */ /* Fast forward. */
i = count - cut; i = count - cut;
len += snprintf((buf + len), (size - len), len += scnprintf((buf + len), (size - len),
"--- %zu bytes skipped ---\n", "--- %zu bytes skipped ---\n",
count - (cut * 2)); count - (cut * 2));
} }
if ((!(i % 10)) && i) { if ((!(i % 10)) && i) {
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"\n"); "\n");
} }
} }
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), "\n"); len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len), "\n");
return len; return len;
} }
...@@ -214,18 +214,18 @@ static ssize_t dbgfs_frame(struct file *file, char __user *user_buf, ...@@ -214,18 +214,18 @@ static ssize_t dbgfs_frame(struct file *file, char __user *user_buf,
return 0; return 0;
/* Print out debug information. */ /* Print out debug information. */
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Current frame:\n"); "Current frame:\n");
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Tx data (Len: %d):\n", cfspi->tx_cpck_len); "Tx data (Len: %d):\n", cfspi->tx_cpck_len);
len += print_frame((buf + len), (DEBUGFS_BUF_SIZE - len), len += print_frame((buf + len), (DEBUGFS_BUF_SIZE - len),
cfspi->xfer.va_tx[0], cfspi->xfer.va_tx[0],
(cfspi->tx_cpck_len + SPI_CMD_SZ), 100); (cfspi->tx_cpck_len + SPI_CMD_SZ), 100);
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
"Rx data (Len: %d):\n", cfspi->rx_cpck_len); "Rx data (Len: %d):\n", cfspi->rx_cpck_len);
len += print_frame((buf + len), (DEBUGFS_BUF_SIZE - len), len += print_frame((buf + len), (DEBUGFS_BUF_SIZE - len),
cfspi->xfer.va_rx, cfspi->xfer.va_rx,
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment
GitLab Nexedi Edition | About GitLab | About Nexedi | 沪ICP备2021021310号-2 | 沪ICP备2021021310号-7