linux-kernel - [PATCH] riscv: ptdump: Replace unbounded sprintf() in dump

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20260127110543.436242-1-thorsten.blum@linux.dev>
Date: Tue, 27 Jan 2026 12:05:40 +0100
From: Thorsten Blum <thorsten.blum@...ux.dev>
To: Paul Walmsley <pjw@...nel.org>,
	Palmer Dabbelt <palmer@...belt.com>,
	Albert Ou <aou@...s.berkeley.edu>,
	Alexandre Ghiti <alex@...ti.fr>,
	Andrew Morton <akpm@...ux-foundation.org>,
	Anshuman Khandual <anshuman.khandual@....com>,
	David Hildenbrand <david@...nel.org>,
	Dev Jain <dev.jain@....com>,
	Josephine Pfeiffer <hi@...ie.lol>
Cc: Thorsten Blum <thorsten.blum@...ux.dev>,
	linux-riscv@...ts.infradead.org,
	linux-kernel@...r.kernel.org
Subject: [PATCH] riscv: ptdump: Replace unbounded sprintf() in dump_prot()

Replace the unbounded sprintf("%s", ...) with the faster and safer
strscpy(). Replace all other sprintf() calls with the safer snprintf().

Signed-off-by: Thorsten Blum <thorsten.blum@...ux.dev>
---
 arch/riscv/mm/ptdump.c | 13 +++++++------
 1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/arch/riscv/mm/ptdump.c b/arch/riscv/mm/ptdump.c
index 34299c2b231f..f4b4a9fcbbd8 100644
--- a/arch/riscv/mm/ptdump.c
+++ b/arch/riscv/mm/ptdump.c
@@ -7,6 +7,7 @@
 #include <linux/init.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/string.h>
 #include <linux/ptdump.h>
 
 #include <linux/pgtable.h>
@@ -213,21 +214,21 @@ static void dump_prot(struct pg_state *st)
 		val = st->current_prot & pte_bits[i].mask;
 		if (val) {
 			if (pte_bits[i].mask == _PAGE_SOFT)
-				sprintf(s, pte_bits[i].set, val >> 8);
+				snprintf(s, sizeof(s), pte_bits[i].set, val >> 8);
 #ifdef CONFIG_64BIT
 			else if (pte_bits[i].mask == _PAGE_MTMASK_SVPBMT) {
 				if (val == _PAGE_NOCACHE_SVPBMT)
-					sprintf(s, pte_bits[i].set, "NC");
+					snprintf(s, sizeof(s), pte_bits[i].set, "NC");
 				else if (val == _PAGE_IO_SVPBMT)
-					sprintf(s, pte_bits[i].set, "IO");
+					snprintf(s, sizeof(s), pte_bits[i].set, "IO");
 				else
-					sprintf(s, pte_bits[i].set, "??");
+					snprintf(s, sizeof(s), pte_bits[i].set, "??");
 			}
 #endif
 			else
-				sprintf(s, "%s", pte_bits[i].set);
+				strscpy(s, pte_bits[i].set);
 		} else {
-			sprintf(s, "%s", pte_bits[i].clear);
+			strscpy(s, pte_bits[i].clear);
 		}
 
 		pt_dump_seq_printf(st->seq, " %s", s);
-- 
Thorsten Blum <thorsten.blum@...ux.dev>
GPG: 1D60 735E 8AEF 3BE4 73B6  9D84 7336 78FD 8DFE EAD4