Skip to content

Commit dcadaec

Browse files
davem330davem330
committed
Merge branch 'net-Use-scnprintf-for-avoiding-potential-buffer-overflow'
Takashi Iwai says: ==================== net: Use scnprintf() for avoiding potential buffer overflow here is a respin of trivial patch series just to convert suspicious snprintf() usages with the more safer one, scnprintf(). v1->v2: Align the remaining lines to the open parenthesis Excluded i40e patch that was already queued ==================== Signed-off-by: David S. Miller <[email protected]>
2 parents cb851c0 + 2da222f commit dcadaec

File tree

6 files changed

+111
-107
lines changed

6 files changed

+111
-107
lines changed

‎drivers/net/caif/caif_spi.c

Lines changed: 36 additions & 36 deletions
Original file line numberDiff line numberDiff line change
@@ -141,29 +141,29 @@ static ssize_t dbgfs_state(struct file *file, char __user *user_buf,
141141
return 0;
142142

143143
/* Print out debug information. */
144-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
145-
"CAIF SPI debug information:\n");
146-
147-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), FLAVOR);
148-
149-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
150-
"STATE: %d\n", cfspi->dbg_state);
151-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
152-
"Previous CMD: 0x%x\n", cfspi->pcmd);
153-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
154-
"Current CMD: 0x%x\n", cfspi->cmd);
155-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
156-
"Previous TX len: %d\n", cfspi->tx_ppck_len);
157-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
158-
"Previous RX len: %d\n", cfspi->rx_ppck_len);
159-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
160-
"Current TX len: %d\n", cfspi->tx_cpck_len);
161-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
162-
"Current RX len: %d\n", cfspi->rx_cpck_len);
163-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
164-
"Next TX len: %d\n", cfspi->tx_npck_len);
165-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
166-
"Next RX len: %d\n", cfspi->rx_npck_len);
144+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
145+
"CAIF SPI debug information:\n");
146+
147+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len), FLAVOR);
148+
149+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
150+
"STATE: %d\n", cfspi->dbg_state);
151+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
152+
"Previous CMD: 0x%x\n", cfspi->pcmd);
153+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
154+
"Current CMD: 0x%x\n", cfspi->cmd);
155+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
156+
"Previous TX len: %d\n", cfspi->tx_ppck_len);
157+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
158+
"Previous RX len: %d\n", cfspi->rx_ppck_len);
159+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
160+
"Current TX len: %d\n", cfspi->tx_cpck_len);
161+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
162+
"Current RX len: %d\n", cfspi->rx_cpck_len);
163+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
164+
"Next TX len: %d\n", cfspi->tx_npck_len);
165+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
166+
"Next RX len: %d\n", cfspi->rx_npck_len);
167167

168168
if (len > DEBUGFS_BUF_SIZE)
169169
len = DEBUGFS_BUF_SIZE;
@@ -180,23 +180,23 @@ static ssize_t print_frame(char *buf, size_t size, char *frm,
180180
int len = 0;
181181
int i;
182182
for (i = 0; i < count; i++) {
183-
len += snprintf((buf + len), (size - len),
183+
len += scnprintf((buf + len), (size - len),
184184
"[0x" BYTE_HEX_FMT "]",
185185
frm[i]);
186186
if ((i == cut) && (count > (cut * 2))) {
187187
/* Fast forward. */
188188
i = count - cut;
189-
len += snprintf((buf + len), (size - len),
190-
"--- %zu bytes skipped ---\n",
191-
count - (cut * 2));
189+
len += scnprintf((buf + len), (size - len),
190+
"--- %zu bytes skipped ---\n",
191+
count - (cut * 2));
192192
}
193193

194194
if ((!(i % 10)) && i) {
195-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
196-
"\n");
195+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
196+
"\n");
197197
}
198198
}
199-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), "\n");
199+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len), "\n");
200200
return len;
201201
}
202202

@@ -214,18 +214,18 @@ static ssize_t dbgfs_frame(struct file *file, char __user *user_buf,
214214
return 0;
215215

216216
/* Print out debug information. */
217-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
218-
"Current frame:\n");
217+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
218+
"Current frame:\n");
219219

220-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
221-
"Tx data (Len: %d):\n", cfspi->tx_cpck_len);
220+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
221+
"Tx data (Len: %d):\n", cfspi->tx_cpck_len);
222222

223223
len += print_frame((buf + len), (DEBUGFS_BUF_SIZE - len),
224224
cfspi->xfer.va_tx[0],
225225
(cfspi->tx_cpck_len + SPI_CMD_SZ), 100);
226226

227-
len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
228-
"Rx data (Len: %d):\n", cfspi->rx_cpck_len);
227+
len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
228+
"Rx data (Len: %d):\n", cfspi->rx_cpck_len);
229229

230230
len += print_frame((buf + len), (DEBUGFS_BUF_SIZE - len),
231231
cfspi->xfer.va_rx,

‎drivers/net/ethernet/mellanox/mlx4/mcg.c

Lines changed: 31 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -906,59 +906,59 @@ static void mlx4_err_rule(struct mlx4_dev *dev, char *str,
906906
int len = 0;
907907

908908
mlx4_err(dev, "%s", str);
909-
len += snprintf(buf + len, BUF_SIZE - len,
910-
"port = %d prio = 0x%x qp = 0x%x ",
911-
rule->port, rule->priority, rule->qpn);
909+
len += scnprintf(buf + len, BUF_SIZE - len,
910+
"port = %d prio = 0x%x qp = 0x%x ",
911+
rule->port, rule->priority, rule->qpn);
912912

913913
list_for_each_entry(cur, &rule->list, list) {
914914
switch (cur->id) {
915915
case MLX4_NET_TRANS_RULE_ID_ETH:
916-
len += snprintf(buf + len, BUF_SIZE - len,
917-
"dmac = %pM ", &cur->eth.dst_mac);
916+
len += scnprintf(buf + len, BUF_SIZE - len,
917+
"dmac = %pM ", &cur->eth.dst_mac);
918918
if (cur->eth.ether_type)
919-
len += snprintf(buf + len, BUF_SIZE - len,
920-
"ethertype = 0x%x ",
921-
be16_to_cpu(cur->eth.ether_type));
919+
len += scnprintf(buf + len, BUF_SIZE - len,
920+
"ethertype = 0x%x ",
921+
be16_to_cpu(cur->eth.ether_type));
922922
if (cur->eth.vlan_id)
923-
len += snprintf(buf + len, BUF_SIZE - len,
924-
"vlan-id = %d ",
925-
be16_to_cpu(cur->eth.vlan_id));
923+
len += scnprintf(buf + len, BUF_SIZE - len,
924+
"vlan-id = %d ",
925+
be16_to_cpu(cur->eth.vlan_id));
926926
break;
927927

928928
case MLX4_NET_TRANS_RULE_ID_IPV4:
929929
if (cur->ipv4.src_ip)
930-
len += snprintf(buf + len, BUF_SIZE - len,
931-
"src-ip = %pI4 ",
932-
&cur->ipv4.src_ip);
930+
len += scnprintf(buf + len, BUF_SIZE - len,
931+
"src-ip = %pI4 ",
932+
&cur->ipv4.src_ip);
933933
if (cur->ipv4.dst_ip)
934-
len += snprintf(buf + len, BUF_SIZE - len,
935-
"dst-ip = %pI4 ",
936-
&cur->ipv4.dst_ip);
934+
len += scnprintf(buf + len, BUF_SIZE - len,
935+
"dst-ip = %pI4 ",
936+
&cur->ipv4.dst_ip);
937937
break;
938938

939939
case MLX4_NET_TRANS_RULE_ID_TCP:
940940
case MLX4_NET_TRANS_RULE_ID_UDP:
941941
if (cur->tcp_udp.src_port)
942-
len += snprintf(buf + len, BUF_SIZE - len,
943-
"src-port = %d ",
944-
be16_to_cpu(cur->tcp_udp.src_port));
942+
len += scnprintf(buf + len, BUF_SIZE - len,
943+
"src-port = %d ",
944+
be16_to_cpu(cur->tcp_udp.src_port));
945945
if (cur->tcp_udp.dst_port)
946-
len += snprintf(buf + len, BUF_SIZE - len,
947-
"dst-port = %d ",
948-
be16_to_cpu(cur->tcp_udp.dst_port));
946+
len += scnprintf(buf + len, BUF_SIZE - len,
947+
"dst-port = %d ",
948+
be16_to_cpu(cur->tcp_udp.dst_port));
949949
break;
950950

951951
case MLX4_NET_TRANS_RULE_ID_IB:
952-
len += snprintf(buf + len, BUF_SIZE - len,
953-
"dst-gid = %pI6\n", cur->ib.dst_gid);
954-
len += snprintf(buf + len, BUF_SIZE - len,
955-
"dst-gid-mask = %pI6\n",
956-
cur->ib.dst_gid_msk);
952+
len += scnprintf(buf + len, BUF_SIZE - len,
953+
"dst-gid = %pI6\n", cur->ib.dst_gid);
954+
len += scnprintf(buf + len, BUF_SIZE - len,
955+
"dst-gid-mask = %pI6\n",
956+
cur->ib.dst_gid_msk);
957957
break;
958958

959959
case MLX4_NET_TRANS_RULE_ID_VXLAN:
960-
len += snprintf(buf + len, BUF_SIZE - len,
961-
"VNID = %d ", be32_to_cpu(cur->vxlan.vni));
960+
len += scnprintf(buf + len, BUF_SIZE - len,
961+
"VNID = %d ", be32_to_cpu(cur->vxlan.vni));
962962
break;
963963
case MLX4_NET_TRANS_RULE_ID_IPV6:
964964
break;
@@ -967,7 +967,7 @@ static void mlx4_err_rule(struct mlx4_dev *dev, char *str,
967967
break;
968968
}
969969
}
970-
len += snprintf(buf + len, BUF_SIZE - len, "\n");
970+
len += scnprintf(buf + len, BUF_SIZE - len, "\n");
971971
mlx4_err(dev, "%s", buf);
972972

973973
if (len >= BUF_SIZE)

‎drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -616,7 +616,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
616616
if (bar->iomem) {
617617
int pf;
618618

619-
msg += snprintf(msg, end - msg, "0.0: General/MSI-X SRAM, ");
619+
msg += scnprintf(msg, end - msg, "0.0: General/MSI-X SRAM, ");
620620
atomic_inc(&bar->refcnt);
621621
bars_free--;
622622

@@ -661,7 +661,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
661661

662662
/* Configure, and lock, BAR0.1 for PCIe XPB (MSI-X PBA) */
663663
bar = &nfp->bar[1];
664-
msg += snprintf(msg, end - msg, "0.1: PCIe XPB/MSI-X PBA, ");
664+
msg += scnprintf(msg, end - msg, "0.1: PCIe XPB/MSI-X PBA, ");
665665
atomic_inc(&bar->refcnt);
666666
bars_free--;
667667

@@ -680,8 +680,8 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
680680
bar->iomem = ioremap(nfp_bar_resource_start(bar),
681681
nfp_bar_resource_len(bar));
682682
if (bar->iomem) {
683-
msg += snprintf(msg, end - msg,
684-
"0.%d: Explicit%d, ", 4 + i, i);
683+
msg += scnprintf(msg, end - msg,
684+
"0.%d: Explicit%d, ", 4 + i, i);
685685
atomic_inc(&bar->refcnt);
686686
bars_free--;
687687

‎drivers/net/ethernet/pensando/ionic/ionic_lif.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -948,18 +948,18 @@ static void ionic_lif_rx_mode(struct ionic_lif *lif, unsigned int rx_mode)
948948
int i;
949949
#define REMAIN(__x) (sizeof(buf) - (__x))
950950

951-
i = snprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:",
952-
lif->rx_mode, rx_mode);
951+
i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:",
952+
lif->rx_mode, rx_mode);
953953
if (rx_mode & IONIC_RX_MODE_F_UNICAST)
954-
i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST");
954+
i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST");
955955
if (rx_mode & IONIC_RX_MODE_F_MULTICAST)
956-
i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST");
956+
i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST");
957957
if (rx_mode & IONIC_RX_MODE_F_BROADCAST)
958-
i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST");
958+
i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST");
959959
if (rx_mode & IONIC_RX_MODE_F_PROMISC)
960-
i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC");
960+
i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC");
961961
if (rx_mode & IONIC_RX_MODE_F_ALLMULTI)
962-
i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI");
962+
i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI");
963963
netdev_dbg(lif->netdev, "lif%d %s\n", lif->index, buf);
964964

965965
err = ionic_adminq_post_wait(lif, &ctx);

‎drivers/net/ethernet/sfc/mcdi.c

Lines changed: 18 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -212,12 +212,14 @@ static void efx_mcdi_send_request(struct efx_nic *efx, unsigned cmd,
212212
* progress on a NIC at any one time. So no need for locking.
213213
*/
214214
for (i = 0; i < hdr_len / 4 && bytes < PAGE_SIZE; i++)
215-
bytes += snprintf(buf + bytes, PAGE_SIZE - bytes,
216-
" %08x", le32_to_cpu(hdr[i].u32[0]));
215+
bytes += scnprintf(buf + bytes, PAGE_SIZE - bytes,
216+
" %08x",
217+
le32_to_cpu(hdr[i].u32[0]));
217218

218219
for (i = 0; i < inlen / 4 && bytes < PAGE_SIZE; i++)
219-
bytes += snprintf(buf + bytes, PAGE_SIZE - bytes,
220-
" %08x", le32_to_cpu(inbuf[i].u32[0]));
220+
bytes += scnprintf(buf + bytes, PAGE_SIZE - bytes,
221+
" %08x",
222+
le32_to_cpu(inbuf[i].u32[0]));
221223

222224
netif_info(efx, hw, efx->net_dev, "MCDI RPC REQ:%s\n", buf);
223225
}
@@ -302,15 +304,15 @@ static void efx_mcdi_read_response_header(struct efx_nic *efx)
302304
*/
303305
for (i = 0; i < hdr_len && bytes < PAGE_SIZE; i++) {
304306
efx->type->mcdi_read_response(efx, &hdr, (i * 4), 4);
305-
bytes += snprintf(buf + bytes, PAGE_SIZE - bytes,
306-
" %08x", le32_to_cpu(hdr.u32[0]));
307+
bytes += scnprintf(buf + bytes, PAGE_SIZE - bytes,
308+
" %08x", le32_to_cpu(hdr.u32[0]));
307309
}
308310

309311
for (i = 0; i < data_len && bytes < PAGE_SIZE; i++) {
310312
efx->type->mcdi_read_response(efx, &hdr,
311313
mcdi->resp_hdr_len + (i * 4), 4);
312-
bytes += snprintf(buf + bytes, PAGE_SIZE - bytes,
313-
" %08x", le32_to_cpu(hdr.u32[0]));
314+
bytes += scnprintf(buf + bytes, PAGE_SIZE - bytes,
315+
" %08x", le32_to_cpu(hdr.u32[0]));
314316
}
315317

316318
netif_info(efx, hw, efx->net_dev, "MCDI RPC RESP:%s\n", buf);
@@ -1417,19 +1419,21 @@ void efx_mcdi_print_fwver(struct efx_nic *efx, char *buf, size_t len)
14171419
}
14181420

14191421
ver_words = (__le16 *)MCDI_PTR(outbuf, GET_VERSION_OUT_VERSION);
1420-
offset = snprintf(buf, len, "%u.%u.%u.%u",
1421-
le16_to_cpu(ver_words[0]), le16_to_cpu(ver_words[1]),
1422-
le16_to_cpu(ver_words[2]), le16_to_cpu(ver_words[3]));
1422+
offset = scnprintf(buf, len, "%u.%u.%u.%u",
1423+
le16_to_cpu(ver_words[0]),
1424+
le16_to_cpu(ver_words[1]),
1425+
le16_to_cpu(ver_words[2]),
1426+
le16_to_cpu(ver_words[3]));
14231427

14241428
/* EF10 may have multiple datapath firmware variants within a
14251429
* single version. Report which variants are running.
14261430
*/
14271431
if (efx_nic_rev(efx) >= EFX_REV_HUNT_A0) {
14281432
struct efx_ef10_nic_data *nic_data = efx->nic_data;
14291433

1430-
offset += snprintf(buf + offset, len - offset, " rx%x tx%x",
1431-
nic_data->rx_dpcpu_fw_id,
1432-
nic_data->tx_dpcpu_fw_id);
1434+
offset += scnprintf(buf + offset, len - offset, " rx%x tx%x",
1435+
nic_data->rx_dpcpu_fw_id,
1436+
nic_data->tx_dpcpu_fw_id);
14331437

14341438
/* It's theoretically possible for the string to exceed 31
14351439
* characters, though in practice the first three version

‎drivers/net/netdevsim/ipsec.c

Lines changed: 15 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -29,28 +29,28 @@ static ssize_t nsim_dbg_netdev_ops_read(struct file *filp,
2929
return -ENOMEM;
3030

3131
p = buf;
32-
p += snprintf(p, bufsize - (p - buf),
33-
"SA count=%u tx=%u\n",
34-
ipsec->count, ipsec->tx);
32+
p += scnprintf(p, bufsize - (p - buf),
33+
"SA count=%u tx=%u\n",
34+
ipsec->count, ipsec->tx);
3535

3636
for (i = 0; i < NSIM_IPSEC_MAX_SA_COUNT; i++) {
3737
struct nsim_sa *sap = &ipsec->sa[i];
3838

3939
if (!sap->used)
4040
continue;
4141

42-
p += snprintf(p, bufsize - (p - buf),
43-
"sa[%i] %cx ipaddr=0x%08x %08x %08x %08x\n",
44-
i, (sap->rx ? 'r' : 't'), sap->ipaddr[0],
45-
sap->ipaddr[1], sap->ipaddr[2], sap->ipaddr[3]);
46-
p += snprintf(p, bufsize - (p - buf),
47-
"sa[%i] spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n",
48-
i, be32_to_cpu(sap->xs->id.spi),
49-
sap->xs->id.proto, sap->salt, sap->crypt);
50-
p += snprintf(p, bufsize - (p - buf),
51-
"sa[%i] key=0x%08x %08x %08x %08x\n",
52-
i, sap->key[0], sap->key[1],
53-
sap->key[2], sap->key[3]);
42+
p += scnprintf(p, bufsize - (p - buf),
43+
"sa[%i] %cx ipaddr=0x%08x %08x %08x %08x\n",
44+
i, (sap->rx ? 'r' : 't'), sap->ipaddr[0],
45+
sap->ipaddr[1], sap->ipaddr[2], sap->ipaddr[3]);
46+
p += scnprintf(p, bufsize - (p - buf),
47+
"sa[%i] spi=0x%08x proto=0x%x salt=0x%08x crypt=%d\n",
48+
i, be32_to_cpu(sap->xs->id.spi),
49+
sap->xs->id.proto, sap->salt, sap->crypt);
50+
p += scnprintf(p, bufsize - (p - buf),
51+
"sa[%i] key=0x%08x %08x %08x %08x\n",
52+
i, sap->key[0], sap->key[1],
53+
sap->key[2], sap->key[3]);
5454
}
5555

5656
len = simple_read_from_buffer(buffer, count, ppos, buf, p - buf);

0 commit comments

Comments
 (0)