| Message ID | d4b1a995-a0cb-4125-aa1d-5fd5044aba1d@moroto.mountain (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 75a384ceda93df0ec2436f0188e58f166a609c49 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next] ptp: prevent string overflow | expand |
On 10/18/23 16:20, Dan Carpenter wrote: > The ida_alloc_max() function can return up to INT_MAX so this buffer is > not large enough. Also use snprintf() for extra safety. > > Fixes: 403376ddb422 ("ptp: add debugfs interface to see applied channel masks") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > drivers/ptp/ptp_clock.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) > > diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c > index 2e801cd33220..3d1b0a97301c 100644 > --- a/drivers/ptp/ptp_clock.c > +++ b/drivers/ptp/ptp_clock.c > @@ -220,7 +220,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, > struct ptp_clock *ptp; > struct timestamp_event_queue *queue = NULL; > int err = 0, index, major = MAJOR(ptp_devt); > - char debugfsname[8]; > + char debugfsname[16]; > size_t size; > > if (info->n_alarm > PTP_MAX_ALARMS) > @@ -343,7 +343,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, > } > > /* Debugfs initialization */ > - sprintf(debugfsname, "ptp%d", ptp->index); > + snprintf(debugfsname, sizeof(debugfsname), "ptp%d", ptp->index); > ptp->debugfs_root = debugfs_create_dir(debugfsname, NULL); > > return ptp; Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>
Nice catch Dan. Thank you very much for the fix! Looks good to me. Cheers, Xabier.
Hello: This patch was applied to netdev/net-next.git (main) by Jakub Kicinski <kuba@kernel.org>: On Wed, 18 Oct 2023 17:20:11 +0300 you wrote: > The ida_alloc_max() function can return up to INT_MAX so this buffer is > not large enough. Also use snprintf() for extra safety. > > Fixes: 403376ddb422 ("ptp: add debugfs interface to see applied channel masks") > Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> > --- > drivers/ptp/ptp_clock.c | 4 ++-- > 1 file changed, 2 insertions(+), 2 deletions(-) Here is the summary with links: - [net-next] ptp: prevent string overflow https://git.kernel.org/netdev/net-next/c/75a384ceda93 You are awesome, thank you!
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c index 2e801cd33220..3d1b0a97301c 100644 --- a/drivers/ptp/ptp_clock.c +++ b/drivers/ptp/ptp_clock.c @@ -220,7 +220,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, struct ptp_clock *ptp; struct timestamp_event_queue *queue = NULL; int err = 0, index, major = MAJOR(ptp_devt); - char debugfsname[8]; + char debugfsname[16]; size_t size; if (info->n_alarm > PTP_MAX_ALARMS) @@ -343,7 +343,7 @@ struct ptp_clock *ptp_clock_register(struct ptp_clock_info *info, } /* Debugfs initialization */ - sprintf(debugfsname, "ptp%d", ptp->index); + snprintf(debugfsname, sizeof(debugfsname), "ptp%d", ptp->index); ptp->debugfs_root = debugfs_create_dir(debugfsname, NULL); return ptp;
The ida_alloc_max() function can return up to INT_MAX so this buffer is not large enough. Also use snprintf() for extra safety. Fixes: 403376ddb422 ("ptp: add debugfs interface to see applied channel masks") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> --- drivers/ptp/ptp_clock.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)