linux-kernel - Re: [PATCH] scsi: isci: convert sysfs sprintf/snprintf family to sysfs

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <a6093892d7201fb940e14a571bc853829e704d0f.camel@linux.ibm.com>
Date:   Wed, 03 Feb 2021 08:15:22 -0800
From:   James Bottomley <jejb@...ux.ibm.com>
To:     Jiapeng Chong <jiapeng.chong@...ux.alibaba.com>,
        intel-linux-scu@...el.com
Cc:     artur.paszkiewicz@...el.com, martin.petersen@...cle.com,
        linux-scsi@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: [PATCH] scsi: isci: convert sysfs sprintf/snprintf family to
 sysfs_emit

On Wed, 2021-02-03 at 16:43 +0800, Jiapeng Chong wrote:
> Fix the following coccicheck warning:
> 
>  ./drivers/scsi/isci/init.c:140:8-16: WARNING: use scnprintf or
> sprintf.
> 
> Reported-by: Abaci Robot<abaci@...ux.alibaba.com>
> Signed-off-by: Jiapeng Chong <jiapeng.chong@...ux.alibaba.com>
> ---
>  drivers/scsi/isci/init.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
> index c452849..741a98e 100644
> --- a/drivers/scsi/isci/init.c
> +++ b/drivers/scsi/isci/init.c
> @@ -137,7 +137,7 @@ static ssize_t isci_show_id(struct device *dev,
> struct device_attribute *attr, c
>  	struct sas_ha_struct *sas_ha = SHOST_TO_SAS_HA(shost);
>  	struct isci_host *ihost = container_of(sas_ha, typeof(*ihost),
> sas_ha);
>  
> -	return snprintf(buf, PAGE_SIZE, "%d\n", ihost->id);
> +	return sysfs_emit(buf, "%d\n", ihost->id);

What's the point of doing this change?  We'd have to have 13,600 bit
integer types before this could ever possibly overflow and the
difference between snprintf and scnprintf actually matter from a
practical point of view.  Perhaps the coccinelle check should be
updated to account for these common impossible to overflow situations.

James