| Message ID | 20200311083745.17328-6-tiwai@suse.de |
|---|---|
| State | Changes Requested |
| Delegated to: | David Miller |
| Headers | show |
| Series | net: Use scnprintf() for avoiding potential buffer overflow | expand |
On Wed, Mar 11, 2020 at 09:37:43AM +0100, Takashi Iwai wrote: > Since snprintf() returns the would-be-output size instead of the > actual output size, the succeeding calls may go beyond the given > buffer limit. Fix it by replacing with scnprintf(). > > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: oss-drivers@netronome.com > Signed-off-by: Takashi Iwai <tiwai@suse.de> Reviewed-by: Simon Horman <simon.horman@netronome.com>
On 3/11/20 1:37 AM, Takashi Iwai wrote: > Since snprintf() returns the would-be-output size instead of the > actual output size, the succeeding calls may go beyond the given > buffer limit. Fix it by replacing with scnprintf(). > > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: oss-drivers@netronome.com > Signed-off-by: Takashi Iwai <tiwai@suse.de> For ionic: Acked-by: Shannon Nelson <snelson@pensando.io> > --- > drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c | 2 +- > drivers/net/ethernet/pensando/ionic/ionic_lif.c | 12 ++++++------ > 2 files changed, 7 insertions(+), 7 deletions(-) > > diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c > index cc311989e3d7..7d518999250d 100644 > --- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c > +++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c > @@ -616,7 +616,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface) > if (bar->iomem) { > int pf; > > - msg += scnprintf(msg, end - msg, "0.0: General/MSI-X SRAM, "); > + msg += scnprintf(msg, end - msg, "0.0: General/MSI-X SRAM, "); > atomic_inc(&bar->refcnt); > bars_free--; > > diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c > index c2f5b691e0fa..09c776191edd 100644 > --- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c > +++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c > @@ -948,18 +948,18 @@ static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode) > int i; > #define REMAIN(__x) (sizeof(buf) - (__x)) > > - i = snprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:", > + i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:", > lif->rx_mode, rx_mode); > if (rx_mode & IONIC_RX_MODE_F_UNICAST) > - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST"); > + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST"); > if (rx_mode & IONIC_RX_MODE_F_MULTICAST) > - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST"); > + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST"); > if (rx_mode & IONIC_RX_MODE_F_BROADCAST) > - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST"); > + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST"); > if (rx_mode & IONIC_RX_MODE_F_PROMISC) > - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC"); > + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC"); > if (rx_mode & IONIC_RX_MODE_F_ALLMULTI) > - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI"); > + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI"); > netdev_dbg(lif->netdev, "lif%d %s\n", lif->index, buf); > > err = ionic_adminq_post_wait(lif, &ctx);
diff --git a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c index cc311989e3d7..7d518999250d 100644 --- a/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c +++ b/drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c @@ -616,7 +616,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface) if (bar->iomem) { int pf; - msg += scnprintf(msg, end - msg, "0.0: General/MSI-X SRAM, "); + msg += scnprintf(msg, end - msg, "0.0: General/MSI-X SRAM, "); atomic_inc(&bar->refcnt); bars_free--; diff --git a/drivers/net/ethernet/pensando/ionic/ionic_lif.c b/drivers/net/ethernet/pensando/ionic/ionic_lif.c index c2f5b691e0fa..09c776191edd 100644 --- a/drivers/net/ethernet/pensando/ionic/ionic_lif.c +++ b/drivers/net/ethernet/pensando/ionic/ionic_lif.c @@ -948,18 +948,18 @@ static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode) int i; #define REMAIN(__x) (sizeof(buf) - (__x)) - i = snprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:", + i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:", lif->rx_mode, rx_mode); if (rx_mode & IONIC_RX_MODE_F_UNICAST) - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST"); + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST"); if (rx_mode & IONIC_RX_MODE_F_MULTICAST) - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST"); + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST"); if (rx_mode & IONIC_RX_MODE_F_BROADCAST) - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST"); + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST"); if (rx_mode & IONIC_RX_MODE_F_PROMISC) - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC"); + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC"); if (rx_mode & IONIC_RX_MODE_F_ALLMULTI) - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI"); + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI"); netdev_dbg(lif->netdev, "lif%d %s\n", lif->index, buf); err = ionic_adminq_post_wait(lif, &ctx);
Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Cc: Jakub Kicinski <kuba@kernel.org> Cc: oss-drivers@netronome.com Signed-off-by: Takashi Iwai <tiwai@suse.de> --- drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c | 2 +- drivers/net/ethernet/pensando/ionic/ionic_lif.c | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-)