| Message ID | 20200311090644.20287-1-tiwai@suse.de (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | pinctrl: mediatek: Use scnprintf() for avoiding potential buffer overflow | expand |
On Wed, 11 Mar 2020 10:06:44 +0100, Takashi Iwai wrote: > > Since snprintf() returns the would-be-output size instead of the > actual output size, the succeeding calls may go beyond the given > buffer limit. Fix it by replacing with scnprintf(). > > Signed-off-by: Takashi Iwai <tiwai@suse.de> A gentle reminder for this forgotten patch. Let me know if any further change is needed. thanks, Takashi > --- > drivers/pinctrl/mediatek/pinctrl-paris.c | 6 +++--- > 1 file changed, 3 insertions(+), 3 deletions(-) > > diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c > index 3ee8086f5e55..3853ec3a2a8e 100644 > --- a/drivers/pinctrl/mediatek/pinctrl-paris.c > +++ b/drivers/pinctrl/mediatek/pinctrl-paris.c > @@ -611,7 +611,7 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, > } else if (pullen != MTK_DISABLE && pullen != MTK_ENABLE) { > pullen = 0; > } > - len += snprintf(buf + len, bufLen - len, > + len += scnprintf(buf + len, bufLen - len, > "%03d: %1d%1d%1d%1d%02d%1d%1d%1d%1d", > gpio, > pinmux, > @@ -625,10 +625,10 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, > pullup); > > if (r1 != -1) { > - len += snprintf(buf + len, bufLen - len, " (%1d %1d)\n", > + len += scnprintf(buf + len, bufLen - len, " (%1d %1d)\n", > r1, r0); > } else { > - len += snprintf(buf + len, bufLen - len, "\n"); > + len += scnprintf(buf + len, bufLen - len, "\n"); > } > > return len; > -- > 2.16.4 >
On Wed, Mar 11, 2020 at 10:06 AM Takashi Iwai <tiwai@suse.de> wrote: > Since snprintf() returns the would-be-output size instead of the > actual output size, the succeeding calls may go beyond the given > buffer limit. Fix it by replacing with scnprintf(). > > Signed-off-by: Takashi Iwai <tiwai@suse.de> No reaction from maintainers so patch applied. Yours, Linus Walleij
diff --git a/drivers/pinctrl/mediatek/pinctrl-paris.c b/drivers/pinctrl/mediatek/pinctrl-paris.c index 3ee8086f5e55..3853ec3a2a8e 100644 --- a/drivers/pinctrl/mediatek/pinctrl-paris.c +++ b/drivers/pinctrl/mediatek/pinctrl-paris.c @@ -611,7 +611,7 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, } else if (pullen != MTK_DISABLE && pullen != MTK_ENABLE) { pullen = 0; } - len += snprintf(buf + len, bufLen - len, + len += scnprintf(buf + len, bufLen - len, "%03d: %1d%1d%1d%1d%02d%1d%1d%1d%1d", gpio, pinmux, @@ -625,10 +625,10 @@ ssize_t mtk_pctrl_show_one_pin(struct mtk_pinctrl *hw, pullup); if (r1 != -1) { - len += snprintf(buf + len, bufLen - len, " (%1d %1d)\n", + len += scnprintf(buf + len, bufLen - len, " (%1d %1d)\n", r1, r0); } else { - len += snprintf(buf + len, bufLen - len, "\n"); + len += scnprintf(buf + len, bufLen - len, "\n"); } return len;
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Signed-off-by: Takashi Iwai <tiwai@suse.de> --- drivers/pinctrl/mediatek/pinctrl-paris.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-)