Update sprintf in serial_show frunction to scnprintf command to
prevent sysfs buffer overflow (buffer always is PAGE_SIZE bytes).

Signed-off-by: Viacheslav Bocharov <adeep@lexina.in>
---
 drivers/firmware/meson/meson_sm.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c
index ed60f1103053..c1c694b485ee 100644
--- a/drivers/firmware/meson/meson_sm.c
+++ b/drivers/firmware/meson/meson_sm.c
@@ -265,7 +265,7 @@ static ssize_t serial_show(struct device *dev, struct device_attribute *attr,
 		return ret;
 	}
 
-	ret = sprintf(buf, "%12phN\n", &id_buf[SM_CHIP_ID_OFFSET]);
+	ret = scnprintf(buf, PAGE_SIZE, "%12phN\n", &id_buf[SM_CHIP_ID_OFFSET]);
 
 	kfree(id_buf);
 
-- 
2.34.1

From: Viacheslav Bocharov
> Sent: 09 November 2023 08:50
> 
> Update sprintf in serial_show frunction to scnprintf command to
> prevent sysfs buffer overflow (buffer always is PAGE_SIZE bytes).

Isn't the correct function sysfs_emit() ?

In any case that particular example can't possibly overflow.

	David

> 
> Signed-off-by: Viacheslav Bocharov <adeep@lexina.in>
> ---
>  drivers/firmware/meson/meson_sm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c
> index ed60f1103053..c1c694b485ee 100644
> --- a/drivers/firmware/meson/meson_sm.c
> +++ b/drivers/firmware/meson/meson_sm.c
> @@ -265,7 +265,7 @@ static ssize_t serial_show(struct device *dev, struct device_attribute *attr,
>  		return ret;
>  	}
> 
> -	ret = sprintf(buf, "%12phN\n", &id_buf[SM_CHIP_ID_OFFSET]);
> +	ret = scnprintf(buf, PAGE_SIZE, "%12phN\n", &id_buf[SM_CHIP_ID_OFFSET]);
> 
>  	kfree(id_buf);
> 
> --
> 2.34.1

-
Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
Registration No: 1397386 (Wales)

Hi!

On Thu, 2023-11-09 at 17:59 +0000, David Laight wrote:
> From: Viacheslav Bocharov
> > Sent: 09 November 2023 08:50
> > 
> > Update sprintf in serial_show frunction to scnprintf command to
> > prevent sysfs buffer overflow (buffer always is PAGE_SIZE bytes).
> 
> Isn't the correct function sysfs_emit() ?
Good catch. There's always something new to find)



> In any case that particular example can't possibly overflow.
Practically in this example, I agree. But nevertheless, ideologically, 
a pointer to the buffer is passed to the function, but its size is not 
passed. This may cause an overflow error when making changes in the 
code. Yes, the lengths of %12phN and PAGE_SIZE are very different at 
the moment. But what happens if both of these numbers change 
unpredictably in future changes?


> 	David
> 
> > 
> > Signed-off-by: Viacheslav Bocharov <adeep@lexina.in>
> > ---
> >  drivers/firmware/meson/meson_sm.c | 2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> > 
> > diff --git a/drivers/firmware/meson/meson_sm.c b/drivers/firmware/meson/meson_sm.c
> > index ed60f1103053..c1c694b485ee 100644
> > --- a/drivers/firmware/meson/meson_sm.c
> > +++ b/drivers/firmware/meson/meson_sm.c
> > @@ -265,7 +265,7 @@ static ssize_t serial_show(struct device *dev, struct device_attribute *attr,
> >  		return ret;
> >  	}
> > 
> > -	ret = sprintf(buf, "%12phN\n", &id_buf[SM_CHIP_ID_OFFSET]);
> > +	ret = scnprintf(buf, PAGE_SIZE, "%12phN\n", &id_buf[SM_CHIP_ID_OFFSET]);
> > 
> >  	kfree(id_buf);
> > 
> > --
> > 2.34.1
> 
> -
> Registered Address Lakeside, Bramley Road, Mount Farm, Milton Keynes, MK1 1PT, UK
> Registration No: 1397386 (Wales)
> 
> 
> _______________________________________________
> linux-amlogic mailing list
> linux-amlogic@lists.infradead.org
> http://lists.infradead.org/mailman/listinfo/linux-amlogic