From nobody Thu Dec 18 19:27:55 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 03863C10DC1 for ; Thu, 30 Nov 2023 10:55:21 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345104AbjK3KzM (ORCPT ); Thu, 30 Nov 2023 05:55:12 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57738 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345084AbjK3KzH (ORCPT ); Thu, 30 Nov 2023 05:55:07 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C299510F4 for ; Thu, 30 Nov 2023 02:55:13 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id E26CFC433CA; Thu, 30 Nov 2023 10:55:11 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1701341713; bh=5UqF6R+sWlvabSQcifcTgrUGPsaALtx849UaV5ZfAKQ=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=EOBnh8dQw28r6W0KPBw5vHS0NSBkkMQADsIb+Ve3s5U/7V/iBgkdOyaSMTt6ijwzj 6Ov39DhGrVN/xtHRUygR0xpAkRjnXxyWBY4uBB/iS+11vAe2+40UEvgD8xqgcUzd+e HM/otnXIKQTW5mBIvxY9MjH7704FN4JMwb67INriEKjmFuVF0dlyXiPKRxABvydoB4 b1H8w4EnGqE2tD/rrI2SfwQLzNCEORoKyOFeo+dTDhdcx0/aqwFc1tgMmqXbygHXo2 EVo7qW7D7BGO2ZoO34GganL2z0nMzryMQU+WdCfCGr9+UQcU4eZdUgJhCTkivgPOl/ h9e2lzRBWT6Gg== From: Lee Jones To: lee@kernel.org Cc: linux-kernel@vger.kernel.org, Matthieu CASTET , Stanislaw Gruszka , Greg Kroah-Hartman , Damien Bergamini , linux-usb@vger.kernel.org Subject: [PATCH 1/5] usb: atm: Remove snprintf() from sysfs call-backs and replace with sysfs_emit() Date: Thu, 30 Nov 2023 10:54:35 +0000 Message-ID: <20231130105459.3208986-2-lee@kernel.org> X-Mailer: git-send-email 2.43.0.rc1.413.gea7ed67945-goog In-Reply-To: <20231130105459.3208986-1-lee@kernel.org> References: <20231130105459.3208986-1-lee@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Since snprintf() has the documented, but still rather strange trait of returning the length of the data that *would have been* written to the array if space were available, rather than the arguably more useful length of data *actually* written, it is usually considered wise to use something else instead in order to avoid confusion. In the case of sysfs call-backs, new wrappers exist that do just that. This patch replaces the 2 uses of snprintf() found in the sysfs .show() call-backs with the new sysfs_emit() helpers. Whist we're at it, let's replace the sprintf()s as well. For no other reason than consistency. Link: https://lwn.net/Articles/69419/ Link: https://github.com/KSPP/linux/issues/105 Cc: Matthieu CASTET Cc: Stanislaw Gruszka Cc: Greg Kroah-Hartman Cc: Damien Bergamini Cc: linux-usb@vger.kernel.org Signed-off-by: Lee Jones --- drivers/usb/atm/ueagle-atm.c | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/usb/atm/ueagle-atm.c b/drivers/usb/atm/ueagle-atm.c index 5812f7ea7f902..8d5580d8d20a8 100644 --- a/drivers/usb/atm/ueagle-atm.c +++ b/drivers/usb/atm/ueagle-atm.c @@ -2252,7 +2252,7 @@ static ssize_t stat_status_show(struct device *dev, s= truct device_attribute *att sc =3D dev_to_uea(dev); if (!sc) goto out; - ret =3D snprintf(buf, 10, "%08x\n", sc->stats.phy.state); + ret =3D sysfs_emit(buf, "%08x\n", sc->stats.phy.state); out: mutex_unlock(&uea_mutex); return ret; @@ -2318,19 +2318,19 @@ static ssize_t stat_human_status_show(struct device= *dev, =20 switch (modem_state) { case 0: - ret =3D sprintf(buf, "Modem is booting\n"); + ret =3D sysfs_emit(buf, "Modem is booting\n"); break; case 1: - ret =3D sprintf(buf, "Modem is initializing\n"); + ret =3D sysfs_emit(buf, "Modem is initializing\n"); break; case 2: - ret =3D sprintf(buf, "Modem is operational\n"); + ret =3D sysfs_emit(buf, "Modem is operational\n"); break; case 3: - ret =3D sprintf(buf, "Modem synchronization failed\n"); + ret =3D sysfs_emit(buf, "Modem synchronization failed\n"); break; default: - ret =3D sprintf(buf, "Modem state is unknown\n"); + ret =3D sysfs_emit(buf, "Modem state is unknown\n"); break; } out: @@ -2364,7 +2364,7 @@ static ssize_t stat_delin_show(struct device *dev, st= ruct device_attribute *attr delin =3D "LOSS"; } =20 - ret =3D sprintf(buf, "%s\n", delin); + ret =3D sysfs_emit(buf, "%s\n", delin); out: mutex_unlock(&uea_mutex); return ret; @@ -2384,7 +2384,7 @@ static ssize_t stat_##name##_show(struct device *dev,= \ sc =3D dev_to_uea(dev); \ if (!sc) \ goto out; \ - ret =3D snprintf(buf, 10, "%08x\n", sc->stats.phy.name); \ + ret =3D sysfs_emit(buf, "%08x\n", sc->stats.phy.name); \ if (reset) \ sc->stats.phy.name =3D 0; \ out: \ --=20 2.43.0.rc1.413.gea7ed67945-goog From nobody Thu Dec 18 19:27:55 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8660FC4167B for ; Thu, 30 Nov 2023 10:55:23 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345124AbjK3KzO (ORCPT ); Thu, 30 Nov 2023 05:55:14 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38306 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345046AbjK3KzK (ORCPT ); Thu, 30 Nov 2023 05:55:10 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 667E210FA for ; Thu, 30 Nov 2023 02:55:15 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id D9C6CC433C7; Thu, 30 Nov 2023 10:55:13 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1701341715; bh=W8jJlgZ5YEkMVFo7GXvQSzyeogzUbP++bKRPuTNNOWw=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=CaVZ2p039qMYbW4/1hxYB+x9Gy4bRKhvyDsJr7uHxreUuESYlXED0uFuTipBwZRcz m5hkDRSc/5Haa37jdaZdy6oFXYGD5+hqWaKt0YFO+oJ/nEt6/U9OHr1tSbP0xdFPvu GyiDdTEhwjbTXw4FG5bkZotVEIC1VhhKf3RhPd0lh7KxJo+AhkgB2FKyS8lQG3BFmI URBCShZzKzynPSY6iOcE/HCK44bulNxDEZRvb8e3lXlOlMxme7giZlJWdVoGr4kNZG /SWxdgpSwhno5jXdJvPycpKgt2xpHT4wFLKtjjmG9laoDBu/0ZhYO0HfYFnj1fc+D5 fnzN1vv4Gbp9w== From: Lee Jones To: lee@kernel.org Cc: linux-kernel@vger.kernel.org, Pawel Laszczak , Greg Kroah-Hartman , linux-usb@vger.kernel.org Subject: [PATCH 2/5] usb: cdnsp: Replace snprintf() with the safer scnprintf() variant Date: Thu, 30 Nov 2023 10:54:36 +0000 Message-ID: <20231130105459.3208986-3-lee@kernel.org> X-Mailer: git-send-email 2.43.0.rc1.413.gea7ed67945-goog In-Reply-To: <20231130105459.3208986-1-lee@kernel.org> References: <20231130105459.3208986-1-lee@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" There is a general misunderstanding amongst engineers that {v}snprintf() returns the length of the data *actually* encoded into the destination array. However, as per the C99 standard {v}snprintf() really returns the length of the data that *would have been* written if there were enough space for it. This misunderstanding has led to buffer-overruns in the past. It's generally considered safer to use the {v}scnprintf() variants in their place (or even sprintf() in simple cases). So let's do that. The uses in this file all seem to assume that data *has been* written! Link: https://lwn.net/Articles/69419/ Link: https://github.com/KSPP/linux/issues/105 Cc: Pawel Laszczak Cc: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org Signed-off-by: Lee Jones --- drivers/usb/cdns3/cdnsp-debug.h | 354 ++++++++++++++++---------------- 1 file changed, 177 insertions(+), 177 deletions(-) diff --git a/drivers/usb/cdns3/cdnsp-debug.h b/drivers/usb/cdns3/cdnsp-debu= g.h index ad617b7455b9c..cd138acdcce16 100644 --- a/drivers/usb/cdns3/cdnsp-debug.h +++ b/drivers/usb/cdns3/cdnsp-debug.h @@ -187,202 +187,202 @@ static inline const char *cdnsp_decode_trb(char *st= r, size_t size, u32 field0, =20 switch (type) { case TRB_LINK: - ret =3D snprintf(str, size, - "LINK %08x%08x intr %ld type '%s' flags %c:%c:%c:%c", - field1, field0, GET_INTR_TARGET(field2), - cdnsp_trb_type_string(type), - field3 & TRB_IOC ? 'I' : 'i', - field3 & TRB_CHAIN ? 'C' : 'c', - field3 & TRB_TC ? 'T' : 't', - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "LINK %08x%08x intr %ld type '%s' flags %c:%c:%c:%c", + field1, field0, GET_INTR_TARGET(field2), + cdnsp_trb_type_string(type), + field3 & TRB_IOC ? 'I' : 'i', + field3 & TRB_CHAIN ? 'C' : 'c', + field3 & TRB_TC ? 'T' : 't', + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_TRANSFER: case TRB_COMPLETION: case TRB_PORT_STATUS: case TRB_HC_EVENT: - ret =3D snprintf(str, size, - "ep%d%s(%d) type '%s' TRB %08x%08x status '%s'" - " len %ld slot %ld flags %c:%c", - ep_num, ep_id % 2 ? "out" : "in", - TRB_TO_EP_INDEX(field3), - cdnsp_trb_type_string(type), field1, field0, - cdnsp_trb_comp_code_string(GET_COMP_CODE(field2)), - EVENT_TRB_LEN(field2), TRB_TO_SLOT_ID(field3), - field3 & EVENT_DATA ? 'E' : 'e', - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "ep%d%s(%d) type '%s' TRB %08x%08x status '%s'" + " len %ld slot %ld flags %c:%c", + ep_num, ep_id % 2 ? "out" : "in", + TRB_TO_EP_INDEX(field3), + cdnsp_trb_type_string(type), field1, field0, + cdnsp_trb_comp_code_string(GET_COMP_CODE(field2)), + EVENT_TRB_LEN(field2), TRB_TO_SLOT_ID(field3), + field3 & EVENT_DATA ? 'E' : 'e', + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_MFINDEX_WRAP: - ret =3D snprintf(str, size, "%s: flags %c", - cdnsp_trb_type_string(type), - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, "%s: flags %c", + cdnsp_trb_type_string(type), + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_SETUP: - ret =3D snprintf(str, size, - "type '%s' bRequestType %02x bRequest %02x " - "wValue %02x%02x wIndex %02x%02x wLength %d " - "length %ld TD size %ld intr %ld Setup ID %ld " - "flags %c:%c:%c", - cdnsp_trb_type_string(type), - field0 & 0xff, - (field0 & 0xff00) >> 8, - (field0 & 0xff000000) >> 24, - (field0 & 0xff0000) >> 16, - (field1 & 0xff00) >> 8, - field1 & 0xff, - (field1 & 0xff000000) >> 16 | - (field1 & 0xff0000) >> 16, - TRB_LEN(field2), GET_TD_SIZE(field2), - GET_INTR_TARGET(field2), - TRB_SETUPID_TO_TYPE(field3), - field3 & TRB_IDT ? 'D' : 'd', - field3 & TRB_IOC ? 'I' : 'i', - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "type '%s' bRequestType %02x bRequest %02x " + "wValue %02x%02x wIndex %02x%02x wLength %d " + "length %ld TD size %ld intr %ld Setup ID %ld " + "flags %c:%c:%c", + cdnsp_trb_type_string(type), + field0 & 0xff, + (field0 & 0xff00) >> 8, + (field0 & 0xff000000) >> 24, + (field0 & 0xff0000) >> 16, + (field1 & 0xff00) >> 8, + field1 & 0xff, + (field1 & 0xff000000) >> 16 | + (field1 & 0xff0000) >> 16, + TRB_LEN(field2), GET_TD_SIZE(field2), + GET_INTR_TARGET(field2), + TRB_SETUPID_TO_TYPE(field3), + field3 & TRB_IDT ? 'D' : 'd', + field3 & TRB_IOC ? 'I' : 'i', + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_DATA: - ret =3D snprintf(str, size, - "type '%s' Buffer %08x%08x length %ld TD size %ld " - "intr %ld flags %c:%c:%c:%c:%c:%c:%c", - cdnsp_trb_type_string(type), - field1, field0, TRB_LEN(field2), - GET_TD_SIZE(field2), - GET_INTR_TARGET(field2), - field3 & TRB_IDT ? 'D' : 'i', - field3 & TRB_IOC ? 'I' : 'i', - field3 & TRB_CHAIN ? 'C' : 'c', - field3 & TRB_NO_SNOOP ? 'S' : 's', - field3 & TRB_ISP ? 'I' : 'i', - field3 & TRB_ENT ? 'E' : 'e', - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "type '%s' Buffer %08x%08x length %ld TD size %ld " + "intr %ld flags %c:%c:%c:%c:%c:%c:%c", + cdnsp_trb_type_string(type), + field1, field0, TRB_LEN(field2), + GET_TD_SIZE(field2), + GET_INTR_TARGET(field2), + field3 & TRB_IDT ? 'D' : 'i', + field3 & TRB_IOC ? 'I' : 'i', + field3 & TRB_CHAIN ? 'C' : 'c', + field3 & TRB_NO_SNOOP ? 'S' : 's', + field3 & TRB_ISP ? 'I' : 'i', + field3 & TRB_ENT ? 'E' : 'e', + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_STATUS: - ret =3D snprintf(str, size, - "Buffer %08x%08x length %ld TD size %ld intr" - "%ld type '%s' flags %c:%c:%c:%c", - field1, field0, TRB_LEN(field2), - GET_TD_SIZE(field2), - GET_INTR_TARGET(field2), - cdnsp_trb_type_string(type), - field3 & TRB_IOC ? 'I' : 'i', - field3 & TRB_CHAIN ? 'C' : 'c', - field3 & TRB_ENT ? 'E' : 'e', - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "Buffer %08x%08x length %ld TD size %ld intr" + "%ld type '%s' flags %c:%c:%c:%c", + field1, field0, TRB_LEN(field2), + GET_TD_SIZE(field2), + GET_INTR_TARGET(field2), + cdnsp_trb_type_string(type), + field3 & TRB_IOC ? 'I' : 'i', + field3 & TRB_CHAIN ? 'C' : 'c', + field3 & TRB_ENT ? 'E' : 'e', + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_NORMAL: case TRB_ISOC: case TRB_EVENT_DATA: case TRB_TR_NOOP: - ret =3D snprintf(str, size, - "type '%s' Buffer %08x%08x length %ld " - "TD size %ld intr %ld " - "flags %c:%c:%c:%c:%c:%c:%c:%c:%c", - cdnsp_trb_type_string(type), - field1, field0, TRB_LEN(field2), - GET_TD_SIZE(field2), - GET_INTR_TARGET(field2), - field3 & TRB_BEI ? 'B' : 'b', - field3 & TRB_IDT ? 'T' : 't', - field3 & TRB_IOC ? 'I' : 'i', - field3 & TRB_CHAIN ? 'C' : 'c', - field3 & TRB_NO_SNOOP ? 'S' : 's', - field3 & TRB_ISP ? 'I' : 'i', - field3 & TRB_ENT ? 'E' : 'e', - field3 & TRB_CYCLE ? 'C' : 'c', - !(field3 & TRB_EVENT_INVALIDATE) ? 'V' : 'v'); + ret =3D scnprintf(str, size, + "type '%s' Buffer %08x%08x length %ld " + "TD size %ld intr %ld " + "flags %c:%c:%c:%c:%c:%c:%c:%c:%c", + cdnsp_trb_type_string(type), + field1, field0, TRB_LEN(field2), + GET_TD_SIZE(field2), + GET_INTR_TARGET(field2), + field3 & TRB_BEI ? 'B' : 'b', + field3 & TRB_IDT ? 'T' : 't', + field3 & TRB_IOC ? 'I' : 'i', + field3 & TRB_CHAIN ? 'C' : 'c', + field3 & TRB_NO_SNOOP ? 'S' : 's', + field3 & TRB_ISP ? 'I' : 'i', + field3 & TRB_ENT ? 'E' : 'e', + field3 & TRB_CYCLE ? 'C' : 'c', + !(field3 & TRB_EVENT_INVALIDATE) ? 'V' : 'v'); break; case TRB_CMD_NOOP: case TRB_ENABLE_SLOT: - ret =3D snprintf(str, size, "%s: flags %c", - cdnsp_trb_type_string(type), - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, "%s: flags %c", + cdnsp_trb_type_string(type), + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_DISABLE_SLOT: - ret =3D snprintf(str, size, "%s: slot %ld flags %c", - cdnsp_trb_type_string(type), - TRB_TO_SLOT_ID(field3), - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, "%s: slot %ld flags %c", + cdnsp_trb_type_string(type), + TRB_TO_SLOT_ID(field3), + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_ADDR_DEV: - ret =3D snprintf(str, size, - "%s: ctx %08x%08x slot %ld flags %c:%c", - cdnsp_trb_type_string(type), field1, field0, - TRB_TO_SLOT_ID(field3), - field3 & TRB_BSR ? 'B' : 'b', - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "%s: ctx %08x%08x slot %ld flags %c:%c", + cdnsp_trb_type_string(type), field1, field0, + TRB_TO_SLOT_ID(field3), + field3 & TRB_BSR ? 'B' : 'b', + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_CONFIG_EP: - ret =3D snprintf(str, size, - "%s: ctx %08x%08x slot %ld flags %c:%c", - cdnsp_trb_type_string(type), field1, field0, - TRB_TO_SLOT_ID(field3), - field3 & TRB_DC ? 'D' : 'd', - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "%s: ctx %08x%08x slot %ld flags %c:%c", + cdnsp_trb_type_string(type), field1, field0, + TRB_TO_SLOT_ID(field3), + field3 & TRB_DC ? 'D' : 'd', + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_EVAL_CONTEXT: - ret =3D snprintf(str, size, - "%s: ctx %08x%08x slot %ld flags %c", - cdnsp_trb_type_string(type), field1, field0, - TRB_TO_SLOT_ID(field3), - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "%s: ctx %08x%08x slot %ld flags %c", + cdnsp_trb_type_string(type), field1, field0, + TRB_TO_SLOT_ID(field3), + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_RESET_EP: case TRB_HALT_ENDPOINT: - ret =3D snprintf(str, size, - "%s: ep%d%s(%d) ctx %08x%08x slot %ld flags %c", - cdnsp_trb_type_string(type), - ep_num, ep_id % 2 ? "out" : "in", - TRB_TO_EP_INDEX(field3), field1, field0, - TRB_TO_SLOT_ID(field3), - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "%s: ep%d%s(%d) ctx %08x%08x slot %ld flags %c", + cdnsp_trb_type_string(type), + ep_num, ep_id % 2 ? "out" : "in", + TRB_TO_EP_INDEX(field3), field1, field0, + TRB_TO_SLOT_ID(field3), + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_STOP_RING: - ret =3D snprintf(str, size, - "%s: ep%d%s(%d) slot %ld sp %d flags %c", - cdnsp_trb_type_string(type), - ep_num, ep_id % 2 ? "out" : "in", - TRB_TO_EP_INDEX(field3), - TRB_TO_SLOT_ID(field3), - TRB_TO_SUSPEND_PORT(field3), - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "%s: ep%d%s(%d) slot %ld sp %d flags %c", + cdnsp_trb_type_string(type), + ep_num, ep_id % 2 ? "out" : "in", + TRB_TO_EP_INDEX(field3), + TRB_TO_SLOT_ID(field3), + TRB_TO_SUSPEND_PORT(field3), + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_SET_DEQ: - ret =3D snprintf(str, size, - "%s: ep%d%s(%d) deq %08x%08x stream %ld slot %ld flags %c", - cdnsp_trb_type_string(type), - ep_num, ep_id % 2 ? "out" : "in", - TRB_TO_EP_INDEX(field3), field1, field0, - TRB_TO_STREAM_ID(field2), - TRB_TO_SLOT_ID(field3), - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "%s: ep%d%s(%d) deq %08x%08x stream %ld slot %ld flags %c", + cdnsp_trb_type_string(type), + ep_num, ep_id % 2 ? "out" : "in", + TRB_TO_EP_INDEX(field3), field1, field0, + TRB_TO_STREAM_ID(field2), + TRB_TO_SLOT_ID(field3), + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_RESET_DEV: - ret =3D snprintf(str, size, "%s: slot %ld flags %c", - cdnsp_trb_type_string(type), - TRB_TO_SLOT_ID(field3), - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, "%s: slot %ld flags %c", + cdnsp_trb_type_string(type), + TRB_TO_SLOT_ID(field3), + field3 & TRB_CYCLE ? 'C' : 'c'); break; case TRB_ENDPOINT_NRDY: temp =3D TRB_TO_HOST_STREAM(field2); =20 - ret =3D snprintf(str, size, - "%s: ep%d%s(%d) H_SID %x%s%s D_SID %lx flags %c:%c", - cdnsp_trb_type_string(type), - ep_num, ep_id % 2 ? "out" : "in", - TRB_TO_EP_INDEX(field3), temp, - temp =3D=3D STREAM_PRIME_ACK ? "(PRIME)" : "", - temp =3D=3D STREAM_REJECTED ? "(REJECTED)" : "", - TRB_TO_DEV_STREAM(field0), - field3 & TRB_STAT ? 'S' : 's', - field3 & TRB_CYCLE ? 'C' : 'c'); + ret =3D scnprintf(str, size, + "%s: ep%d%s(%d) H_SID %x%s%s D_SID %lx flags %c:%c", + cdnsp_trb_type_string(type), + ep_num, ep_id % 2 ? "out" : "in", + TRB_TO_EP_INDEX(field3), temp, + temp =3D=3D STREAM_PRIME_ACK ? "(PRIME)" : "", + temp =3D=3D STREAM_REJECTED ? "(REJECTED)" : "", + TRB_TO_DEV_STREAM(field0), + field3 & TRB_STAT ? 'S' : 's', + field3 & TRB_CYCLE ? 'C' : 'c'); break; default: - ret =3D snprintf(str, size, - "type '%s' -> raw %08x %08x %08x %08x", - cdnsp_trb_type_string(type), - field0, field1, field2, field3); + ret =3D scnprintf(str, size, + "type '%s' -> raw %08x %08x %08x %08x", + cdnsp_trb_type_string(type), + field0, field1, field2, field3); } =20 - if (ret >=3D size) - pr_info("CDNSP: buffer overflowed.\n"); + if (ret =3D=3D size - 1) + pr_info("CDNSP: buffer may be truncated.\n"); =20 return str; } @@ -465,32 +465,32 @@ static inline const char *cdnsp_decode_portsc(char *s= tr, size_t size, { int ret; =20 - ret =3D snprintf(str, size, "%s %s %s Link:%s PortSpeed:%d ", - portsc & PORT_POWER ? "Powered" : "Powered-off", - portsc & PORT_CONNECT ? "Connected" : "Not-connected", - portsc & PORT_PED ? "Enabled" : "Disabled", - cdnsp_portsc_link_state_string(portsc), - DEV_PORT_SPEED(portsc)); + ret =3D scnprintf(str, size, "%s %s %s Link:%s PortSpeed:%d ", + portsc & PORT_POWER ? "Powered" : "Powered-off", + portsc & PORT_CONNECT ? "Connected" : "Not-connected", + portsc & PORT_PED ? "Enabled" : "Disabled", + cdnsp_portsc_link_state_string(portsc), + DEV_PORT_SPEED(portsc)); =20 if (portsc & PORT_RESET) - ret +=3D snprintf(str + ret, size - ret, "In-Reset "); + ret +=3D scnprintf(str + ret, size - ret, "In-Reset "); =20 - ret +=3D snprintf(str + ret, size - ret, "Change: "); + ret +=3D scnprintf(str + ret, size - ret, "Change: "); if (portsc & PORT_CSC) - ret +=3D snprintf(str + ret, size - ret, "CSC "); + ret +=3D scnprintf(str + ret, size - ret, "CSC "); if (portsc & PORT_WRC) - ret +=3D snprintf(str + ret, size - ret, "WRC "); + ret +=3D scnprintf(str + ret, size - ret, "WRC "); if (portsc & PORT_RC) - ret +=3D snprintf(str + ret, size - ret, "PRC "); + ret +=3D scnprintf(str + ret, size - ret, "PRC "); if (portsc & PORT_PLC) - ret +=3D snprintf(str + ret, size - ret, "PLC "); + ret +=3D scnprintf(str + ret, size - ret, "PLC "); if (portsc & PORT_CEC) - ret +=3D snprintf(str + ret, size - ret, "CEC "); - ret +=3D snprintf(str + ret, size - ret, "Wake: "); + ret +=3D scnprintf(str + ret, size - ret, "CEC "); + ret +=3D scnprintf(str + ret, size - ret, "Wake: "); if (portsc & PORT_WKCONN_E) - ret +=3D snprintf(str + ret, size - ret, "WCE "); + ret +=3D scnprintf(str + ret, size - ret, "WCE "); if (portsc & PORT_WKDISC_E) - ret +=3D snprintf(str + ret, size - ret, "WDE "); + ret +=3D scnprintf(str + ret, size - ret, "WDE "); =20 return str; } @@ -562,20 +562,20 @@ static inline const char *cdnsp_decode_ep_context(cha= r *str, size_t size, =20 avg =3D EP_AVG_TRB_LENGTH(tx_info); =20 - ret =3D snprintf(str, size, "State %s mult %d max P. Streams %d %s", - cdnsp_ep_state_string(ep_state), mult, - max_pstr, lsa ? "LSA " : ""); + ret =3D scnprintf(str, size, "State %s mult %d max P. Streams %d %s", + cdnsp_ep_state_string(ep_state), mult, + max_pstr, lsa ? "LSA " : ""); =20 - ret +=3D snprintf(str + ret, size - ret, - "interval %d us max ESIT payload %d CErr %d ", - (1 << interval) * 125, esit, cerr); + ret +=3D scnprintf(str + ret, size - ret, + "interval %d us max ESIT payload %d CErr %d ", + (1 << interval) * 125, esit, cerr); =20 - ret +=3D snprintf(str + ret, size - ret, - "Type %s %sburst %d maxp %d deq %016llx ", - cdnsp_ep_type_string(ep_type), hid ? "HID" : "", - burst, maxp, deq); + ret +=3D scnprintf(str + ret, size - ret, + "Type %s %sburst %d maxp %d deq %016llx ", + cdnsp_ep_type_string(ep_type), hid ? "HID" : "", + burst, maxp, deq); =20 - ret +=3D snprintf(str + ret, size - ret, "avg trb len %d", avg); + ret +=3D scnprintf(str + ret, size - ret, "avg trb len %d", avg); =20 return str; } --=20 2.43.0.rc1.413.gea7ed67945-goog From nobody Thu Dec 18 19:27:55 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 3F959C46CA3 for ; Thu, 30 Nov 2023 10:55:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345132AbjK3KzQ (ORCPT ); Thu, 30 Nov 2023 05:55:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:57796 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345051AbjK3KzL (ORCPT ); Thu, 30 Nov 2023 05:55:11 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 8DB8910DB for ; Thu, 30 Nov 2023 02:55:17 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 83373C433C8; Thu, 30 Nov 2023 10:55:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1701341717; bh=I6SFA46IuAEaiFe3yLVvcqPKp8gUZZ0H2L9FiYb6dRg=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=ODfZqyvsllTcjm4eCiviYTFS9NmmCY4xpKqBkTrGWQ11pzC3k/u7EJKu7gnow+HLD W85Lbo+2NpiarQYU15HIEFe4/VpooV82LNHT4T9ODoCqfOttbCST6L/OSP16CMi47P D+sk//y9F+L+Inr5RB/ovdaJyIlJfU5yN6DUOz88/QUD3IIxNIhG/5yX88mlmgIjOg I2myg9l9zz2tuaunyntzJ4TYi8zqlQxUW13hi8gVKk1P49u90TmebAhmgDvRiKKX4l +1tDauDAmREIua845WZ7QZYEAtWrm39g+qxKLVH9XDYZyfhYX7641iMDAl8yFp4ky6 bMvVtb+cWhNlA== From: Lee Jones To: lee@kernel.org Cc: linux-kernel@vger.kernel.org, Linus Walleij , Greg Kroah-Hartman , Yuan-Hsin Chen , Feng-Hsin Chiang , Po-Yu Chuang , linux-usb@vger.kernel.org Subject: [PATCH 3/5] usb: fotg210-hcd: Replace snprintf() with the safer scnprintf() variant Date: Thu, 30 Nov 2023 10:54:37 +0000 Message-ID: <20231130105459.3208986-4-lee@kernel.org> X-Mailer: git-send-email 2.43.0.rc1.413.gea7ed67945-goog In-Reply-To: <20231130105459.3208986-1-lee@kernel.org> References: <20231130105459.3208986-1-lee@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" There is a general misunderstanding amongst engineers that {v}snprintf() returns the length of the data *actually* encoded into the destination array. However, as per the C99 standard {v}snprintf() really returns the length of the data that *would have been* written if there were enough space for it. This misunderstanding has led to buffer-overruns in the past. It's generally considered safer to use the {v}scnprintf() variants in their place (or even sprintf() in simple cases). So let's do that. The uses in this file both seem to assume that data *has been* written! Link: https://lwn.net/Articles/69419/ Link: https://github.com/KSPP/linux/issues/105 Cc: Linus Walleij Cc: Greg Kroah-Hartman Cc: Yuan-Hsin Chen Cc: Feng-Hsin Chiang Cc: Po-Yu Chuang Cc: linux-usb@vger.kernel.org Signed-off-by: Lee Jones Reviewed-by: Linus Walleij --- drivers/usb/fotg210/fotg210-hcd.c | 12 ++++-------- 1 file changed, 4 insertions(+), 8 deletions(-) diff --git a/drivers/usb/fotg210/fotg210-hcd.c b/drivers/usb/fotg210/fotg21= 0-hcd.c index 929106c16b29b..b2f8b53cc8ef5 100644 --- a/drivers/usb/fotg210/fotg210-hcd.c +++ b/drivers/usb/fotg210/fotg210-hcd.c @@ -404,9 +404,9 @@ static void qh_lines(struct fotg210_hcd *fotg210, struc= t fotg210_qh *qh, else if (td->hw_alt_next !=3D list_end) mark =3D '/'; } - temp =3D snprintf(next, size, - "\n\t%p%c%s len=3D%d %08x urb %p", - td, mark, ({ char *tmp; + temp =3D scnprintf(next, size, + "\n\t%p%c%s len=3D%d %08x urb %p", + td, mark, ({ char *tmp; switch ((scratch>>8)&0x03) { case 0: tmp =3D "out"; @@ -424,17 +424,13 @@ static void qh_lines(struct fotg210_hcd *fotg210, str= uct fotg210_qh *qh, (scratch >> 16) & 0x7fff, scratch, td->urb); - if (size < temp) - temp =3D size; size -=3D temp; next +=3D temp; if (temp =3D=3D size) goto done; } =20 - temp =3D snprintf(next, size, "\n"); - if (size < temp) - temp =3D size; + temp =3D scnprintf(next, size, "\n"); =20 size -=3D temp; next +=3D temp; --=20 2.43.0.rc1.413.gea7ed67945-goog From nobody Thu Dec 18 19:27:55 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 9313DC4167B for ; Thu, 30 Nov 2023 10:55:29 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345138AbjK3KzT (ORCPT ); Thu, 30 Nov 2023 05:55:19 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32792 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345081AbjK3KzM (ORCPT ); Thu, 30 Nov 2023 05:55:12 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 100AB10FA for ; Thu, 30 Nov 2023 02:55:19 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id A841AC433CA; Thu, 30 Nov 2023 10:55:17 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1701341718; bh=/XOh9djbd1kRjRIJaFEo79gsQogKZILFqya3ZNX3dzE=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=M/7ElH+xTwmRE/jQTEQPLVFtUUURsQO7RbtCR9vxOg5H7Gx4ArBGSB9MkUmH5CF5E szynq61yJlRo4ltLpVSCDAMrZQiXgH3j9/qyA5woBqJqjsVy/uNlp5VKKajiNyCKMZ PmuSoGJGgyI611UCzIabzZySOnX+87zpCgULh+zKjXnF2nIZ/BvI58pKkaOUWM8ick mvUGbVqUhRs7VMauF6ygzEG+4Evd0+RI9YYZKy8aEaVn6ng2JizzUyalZjjxkT5LYG ylBtp51MF9qOLB6skfhw2WPf5GU7v6YFGgPJTTiemGSiESLpG1GExPLuPpuFzsZXvR FQ7MWMmPFKteQ== From: Lee Jones To: lee@kernel.org Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman , linux-usb@vger.kernel.org Subject: [PATCH 4/5] usb: gadget: Remove snprintf() from sysfs call-backs and replace with sysfs_emit() Date: Thu, 30 Nov 2023 10:54:38 +0000 Message-ID: <20231130105459.3208986-5-lee@kernel.org> X-Mailer: git-send-email 2.43.0.rc1.413.gea7ed67945-goog In-Reply-To: <20231130105459.3208986-1-lee@kernel.org> References: <20231130105459.3208986-1-lee@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Since snprintf() has the documented, but still rather strange trait of returning the length of the data that *would have been* written to the array if space were available, rather than the arguably more useful length of data *actually* written, it is usually considered wise to use something else instead in order to avoid confusion. In the case of sysfs call-backs, new wrappers exist that do just that. This patch replaces just one use of snprintf() found in the sysfs .show() call-back with the new sysfs_emit() helper. Link: https://lwn.net/Articles/69419/ Link: https://github.com/KSPP/linux/issues/105 Cc: Greg Kroah-Hartman Cc: linux-usb@vger.kernel.org Signed-off-by: Lee Jones --- drivers/usb/gadget/configfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/usb/gadget/configfs.c b/drivers/usb/gadget/configfs.c index 4c639e9ddedc0..b7d2a1313a684 100644 --- a/drivers/usb/gadget/configfs.c +++ b/drivers/usb/gadget/configfs.c @@ -812,7 +812,7 @@ static ssize_t gadget_string_s_show(struct config_item = *item, char *page) struct gadget_string *string =3D to_gadget_string(item); int ret; =20 - ret =3D snprintf(page, sizeof(string->string), "%s\n", string->string); + ret =3D sysfs_emit(page, "%s\n", string->string); return ret; } =20 --=20 2.43.0.rc1.413.gea7ed67945-goog From nobody Thu Dec 18 19:27:55 2025 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C858EC4167B for ; Thu, 30 Nov 2023 10:55:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1345153AbjK3Kz3 (ORCPT ); Thu, 30 Nov 2023 05:55:29 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:32848 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1345109AbjK3KzO (ORCPT ); Thu, 30 Nov 2023 05:55:14 -0500 Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D6A7E170B for ; Thu, 30 Nov 2023 02:55:20 -0800 (PST) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 218E9C433CB; Thu, 30 Nov 2023 10:55:18 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1701341720; bh=EqaFNvqa3Yaf2e/v2zXcPa+NF9mRVVDkSa+wDJv0Wc8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Lp7SZy0NUGDmnnSAUp1ak9WDeEeL2H3QZaY62S6szF6Uimt0rETKvW06GDU2UMBqQ PFL/Wh7mo6eDkzK+rlw0+VmJVokekplOWxPD1oSyUuIW989CUreK3vlsl+BBCT6UbD uakMX3Sbkyo4F04JXRzAmTVsKSgKDPaRBj0oYqCEFDPXNpNzXUQIwlMcnAtrihM/rM cPdP1c/uDBJHA2H0raR/lSYh01PlIFlAw71455l9Ux6r+GSDsl3wAVCHZ5foajhuvG 5aztBRabH35wVkn7sIFZ337MmNW9zM9JmeqqXWEsH2RapDKT9V8RETIbMUvHYZUt2D kkwP4OiYy0/KA== From: Lee Jones To: lee@kernel.org Cc: linux-kernel@vger.kernel.org, Greg Kroah-Hartman , "Martin K. Petersen" , Dmitry Bogdanov , linux-usb@vger.kernel.org Subject: [PATCH 5/5] usb: gadget: f_tcm: Remove snprintf() from sysfs call-backs and replace with sysfs_emit() Date: Thu, 30 Nov 2023 10:54:39 +0000 Message-ID: <20231130105459.3208986-6-lee@kernel.org> X-Mailer: git-send-email 2.43.0.rc1.413.gea7ed67945-goog In-Reply-To: <20231130105459.3208986-1-lee@kernel.org> References: <20231130105459.3208986-1-lee@kernel.org> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Since snprintf() has the documented, but still rather strange trait of returning the length of the data that *would have been* written to the array if space were available, rather than the arguably more useful length of data *actually* written, it is usually considered wise to use something else instead in order to avoid confusion. In the case of sysfs call-backs, new wrappers exist that do just that. This patch replaces just one use of snprintf() found in the sysfs .show() call-back with the new sysfs_emit() helper. Link: https://lwn.net/Articles/69419/ Link: https://github.com/KSPP/linux/issues/105 Cc: Greg Kroah-Hartman Cc: "Martin K. Petersen" Cc: Dmitry Bogdanov Cc: linux-usb@vger.kernel.org Signed-off-by: Lee Jones --- drivers/usb/gadget/function/f_tcm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/usb/gadget/function/f_tcm.c b/drivers/usb/gadget/funct= ion/f_tcm.c index ff33f31bcdf64..37befd6db001a 100644 --- a/drivers/usb/gadget/function/f_tcm.c +++ b/drivers/usb/gadget/function/f_tcm.c @@ -1504,8 +1504,8 @@ static ssize_t tcm_usbg_tpg_nexus_show(struct config_= item *item, char *page) ret =3D -ENODEV; goto out; } - ret =3D snprintf(page, PAGE_SIZE, "%s\n", - tv_nexus->tvn_se_sess->se_node_acl->initiatorname); + ret =3D sysfs_emit(page, "%s\n", + tv_nexus->tvn_se_sess->se_node_acl->initiatorname); out: mutex_unlock(&tpg->tpg_mutex); return ret; --=20 2.43.0.rc1.413.gea7ed67945-goog