linux-kernel - RE: [PATCH] firmware: meson-sm: change sprintf to scnprintf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Thu, 9 Nov 2023 17:59:24 +0000
From:   David Laight <David.Laight@...LAB.COM>
To:     'Viacheslav Bocharov' <adeep@...ina.in>,
        Neil Armstrong <neil.armstrong@...aro.org>,
        Jerome Brunet <jbrunet@...libre.com>,
        "Kevin Hilman" <khilman@...libre.com>,
        Martin Blumenstingl <martin.blumenstingl@...glemail.com>,
        "linux-amlogic@...ts.infradead.org" 
        <linux-amlogic@...ts.infradead.org>,
        "linux-arm-kernel@...ts.infradead.org" 
        <linux-arm-kernel@...ts.infradead.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "devicetree@...r.kernel.org" <devicetree@...r.kernel.org>
Subject: RE: [PATCH] firmware: meson-sm: change sprintf to scnprintf

From: Viacheslav Bocharov
> Sent: 09 November 2023 08:50
> 
> Update sprintf in serial_show frunction to scnprintf command to
> prevent sysfs buffer overflow (buffer always is PAGE_SIZE bytes).

Isn't the correct function sysfs_emit() ?

In any case that particular example can't possibly overflow.

	David

> 
> Signed-off-by: Viacheslav Bocharov <adeep@...ina.in>
> ---
>  drivers/firmware/meson/meson_sm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c
> index ed60f1103053..c1c694b485ee 100644
> --- a/drivers/firmware/meson/meson_sm.c
> +++ b/drivers/firmware/meson/meson_sm.c
> @@ -265,7 +265,7 @@ static ssize_t serial_show(struct device *dev, struct device_attribute *attr,
>  		return ret;
>  	}
> 
> -	ret = sprintf(buf, "%12phN\n", &id_buf[SM_CHIP_ID_OFFSET]);
> +	ret = scnprintf(buf, PAGE_SIZE, "%12phN\n", &id_buf[SM_CHIP_ID_OFFSET]);
> 
>  	kfree(id_buf);
> 
> --
> 2.34.1

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)