netdev - Re: [PATCH 5/7] ionic: Use scnprintf() for avoiding potential buffer overflow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 11 Mar 2020 09:45:22 -0700
From:   Shannon Nelson <snelson@...sando.io>
To:     Takashi Iwai <tiwai@...e.de>, netdev@...r.kernel.org
Cc:     "David S . Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>, oss-drivers@...ronome.com
Subject: Re: [PATCH 5/7] ionic: Use scnprintf() for avoiding potential buffer
 overflow

On 3/11/20 1:37 AM, Takashi Iwai wrote:
> Since snprintf() returns the would-be-output size instead of the
> actual output size, the succeeding calls may go beyond the given
> buffer limit.  Fix it by replacing with scnprintf().
>
> Cc: Jakub Kicinski <kuba@...nel.org>
> Cc: oss-drivers@...ronome.com
> Signed-off-by: Takashi Iwai <tiwai@...e.de>

For ionic:
Acked-by: Shannon Nelson <snelson@...sando.io>


> ---
>   drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c |  2 +-
>   drivers/net/ethernet/pensando/ionic/ionic_lif.c           | 12 ++++++------
>   2 files changed, 7 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
> index cc311989e3d7..7d518999250d 100644
> --- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
> +++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c
> @@ -616,7 +616,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
>   	if (bar->iomem) {
>   		int pf;
>   
> -		msg += scnprintf(msg, end - msg,	"0.0: General/MSI-X SRAM, ");
> +		msg += scnprintf(msg, end - msg, "0.0: General/MSI-X SRAM, ");
>   		atomic_inc(&bar->refcnt);
>   		bars_free--;
>   
> diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
> index c2f5b691e0fa..09c776191edd 100644
> --- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c
> +++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c
> @@ -948,18 +948,18 @@ static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode)
>   	int i;
>   #define REMAIN(__x) (sizeof(buf) - (__x))
>   
> -	i = snprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:",
> +	i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:",
>   		     lif->rx_mode, rx_mode);
>   	if (rx_mode & IONIC_RX_MODE_F_UNICAST)
> -		i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST");
> +		i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST");
>   	if (rx_mode & IONIC_RX_MODE_F_MULTICAST)
> -		i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST");
> +		i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST");
>   	if (rx_mode & IONIC_RX_MODE_F_BROADCAST)
> -		i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST");
> +		i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST");
>   	if (rx_mode & IONIC_RX_MODE_F_PROMISC)
> -		i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC");
> +		i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC");
>   	if (rx_mode & IONIC_RX_MODE_F_ALLMULTI)
> -		i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI");
> +		i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI");
>   	netdev_dbg(lif->netdev, "lif%d %s\n", lif->index, buf);
>   
>   	err = ionic_adminq_post_wait(lif, &ctx);