ad3552r_hs_show_data_source_avail() formats the available data source
names into a 128-byte stack buffer, but bounds each scnprintf() with
PAGE_SIZE instead of the buffer size, so the bound does not protect
the destination at all.

This cannot overflow today - dbgfs_attr_source[] has two entries,
"normal" and "ramp-16bit", 18 bytes formatted - but the bound stops
protecting the stack the day the table grows. Use sizeof(buf) so the
bound matches the destination.

Found by smatch:

  drivers/iio/dac/ad3552r-hs.c:593 ad3552r_hs_show_data_source_avail()
  error: scnprintf() 'buf[len]' too small (128 vs 4096)

Fixes: b1c5d68ea66e ("iio: dac: ad3552r-hs: add support for internal ramp")
Assisted-by: Claude:claude-sonnet-5
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
---
v3:
 - Return to the v1 fix: bound scnprintf() with sizeof(buf) instead
   of switching to sysfs_emit_at(). As Andy noticed in the v2 review,
   this is a custom debugfs read handler formatting a kernel buffer
   for simple_read_from_buffer(), not a sysfs show callback, so
   sysfs_emit_at() does not apply here:
   https://lore.kernel.org/r/als6lRi-H4DM7ra6@ashevche-desk.local
 - Dropped Suggested-by and restored the v1 title; the diff is
   identical to v1.

v2: https://lore.kernel.org/r/20260718044244.7-1-bbnpreetsingh@gmail.com
v1: https://lore.kernel.org/r/20260717040024.7-1-bbnpreetsingh@gmail.com

 drivers/iio/dac/ad3552r-hs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/iio/dac/ad3552r-hs.c b/drivers/iio/dac/ad3552r-hs.c
index 02a124ac4855..f865843aa439 100644
--- a/drivers/iio/dac/ad3552r-hs.c
+++ b/drivers/iio/dac/ad3552r-hs.c
@@ -590,7 +590,7 @@ static ssize_t ad3552r_hs_show_data_source_avail(struct file *f,
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(dbgfs_attr_source); i++) {
-		len += scnprintf(buf + len, PAGE_SIZE - len, "%s ",
+		len += scnprintf(buf + len, sizeof(buf) - len, "%s ",
 				 dbgfs_attr_source[i]);
 	}
 	buf[len - 1] = '\n';

base-commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a
-- 
2.43.0

On Sat, 18 Jul 2026 18:22:36 +0000
Babanpreet Singh <bbnpreetsingh@gmail.com> wrote:

> ad3552r_hs_show_data_source_avail() formats the available data source
> names into a 128-byte stack buffer, but bounds each scnprintf() with
> PAGE_SIZE instead of the buffer size, so the bound does not protect
> the destination at all.
> 
> This cannot overflow today - dbgfs_attr_source[] has two entries,
> "normal" and "ramp-16bit", 18 bytes formatted - but the bound stops
> protecting the stack the day the table grows. Use sizeof(buf) so the
> bound matches the destination.
> 
> Found by smatch:
> 
>   drivers/iio/dac/ad3552r-hs.c:593 ad3552r_hs_show_data_source_avail()
>   error: scnprintf() 'buf[len]' too small (128 vs 4096)
> 
> Fixes: b1c5d68ea66e ("iio: dac: ad3552r-hs: add support for internal ramp")
> Assisted-by: Claude:claude-sonnet-5
> Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
Applied to the fixes-togreg branch of iio.git and marked for stable.

Thanks,

Jonathan

> ---
> v3:
>  - Return to the v1 fix: bound scnprintf() with sizeof(buf) instead
>    of switching to sysfs_emit_at(). As Andy noticed in the v2 review,
>    this is a custom debugfs read handler formatting a kernel buffer
>    for simple_read_from_buffer(), not a sysfs show callback, so
>    sysfs_emit_at() does not apply here:
>    https://lore.kernel.org/r/als6lRi-H4DM7ra6@ashevche-desk.local
>  - Dropped Suggested-by and restored the v1 title; the diff is
>    identical to v1.
> 
> v2: https://lore.kernel.org/r/20260718044244.7-1-bbnpreetsingh@gmail.com
> v1: https://lore.kernel.org/r/20260717040024.7-1-bbnpreetsingh@gmail.com
> 
>  drivers/iio/dac/ad3552r-hs.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/dac/ad3552r-hs.c b/drivers/iio/dac/ad3552r-hs.c
> index 02a124ac4855..f865843aa439 100644
> --- a/drivers/iio/dac/ad3552r-hs.c
> +++ b/drivers/iio/dac/ad3552r-hs.c
> @@ -590,7 +590,7 @@ static ssize_t ad3552r_hs_show_data_source_avail(struct file *f,
>  	int i;
>  
>  	for (i = 0; i < ARRAY_SIZE(dbgfs_attr_source); i++) {
> -		len += scnprintf(buf + len, PAGE_SIZE - len, "%s ",
> +		len += scnprintf(buf + len, sizeof(buf) - len, "%s ",
>  				 dbgfs_attr_source[i]);
>  	}
>  	buf[len - 1] = '\n';
> 
> base-commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a