linux-kernel - [PATCH] drivers: base: power: Optimize array out-of-bounds access logic

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <20241122064422.73500-1-luoxueqin@kylinos.cn>
Date: Fri, 22 Nov 2024 14:44:22 +0800
From: xueqin Luo <luoxueqin@...inos.cn>
To: rafael@...nel.org,
	pavel@....cz,
	len.brown@...el.com,
	gregkh@...uxfoundation.org
Cc: linux-pm@...r.kernel.org,
	linux-kernel@...r.kernel.org,
	xiongxin@...inos.cn,
	xueqin Luo <luoxueqin@...inos.cn>
Subject: [PATCH] drivers: base: power: Optimize array out-of-bounds access logic

The code previously used snprintf to format a string into a buffer and
manually checked for potential buffer overflows by comparing the returned
length with the buffer size. This approach introduced unnecessary
complexity and was prone to subtle errors.

Replaced snprintf with scnprintf, which directly returns the actual number
of characters written to the buffer (excluding the null terminator). This
change eliminates the need for manual overflow checks and simplifies the
buffer offset and size adjustment logic.

Signed-off-by: xueqin Luo <luoxueqin@...inos.cn>
---
 drivers/base/power/trace.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/base/power/trace.c b/drivers/base/power/trace.c
index cd6e559648b2..d8da7195bb00 100644
--- a/drivers/base/power/trace.c
+++ b/drivers/base/power/trace.c
@@ -238,10 +238,8 @@ int show_trace_dev_match(char *buf, size_t size)
 		unsigned int hash = hash_string(DEVSEED, dev_name(dev),
 						DEVHASH);
 		if (hash == value) {
-			int len = snprintf(buf, size, "%s\n",
+			int len = scnprintf(buf, size, "%s\n",
 					    dev_driver_string(dev));
-			if (len > size)
-				len = size;
 			buf += len;
 			ret += len;
 			size -= len;
-- 
2.34.1