Re: [PATCH] ath9k/eeprom: Use scnprintf instead of snprintf

[Kalle Valo <kvalo@codeaurora.org>]

Kees Cook <keescook@chromium.org> wrote:

> Change snprintf to scnprintf. There are generally two cases where using
> snprintf causes problems.
> 
> 1) Uses of size += snprintf(buf, SIZE - size, fmt, ...)  In this case,
> if snprintf would have written more characters than what the buffer
> size (SIZE) is, then size will end up larger than SIZE. In later uses
> of snprintf, SIZE - size will result in a negative number, leading to
> problems. Note that size might already be too large by using size =
> snprintf before the code reaches a case of size += snprintf.
> 
> 2) If size is ultimately used as a length parameter for a copy back to
> user space, then it will potentially allow for a buffer overflow and
> information disclosure when size is greater than SIZE. When the size is
> used to index the buffer directly, we can have memory corruption. This
> also means when size = snprintf... is used, it may also cause problems
> since size may become large. Copying to userspace is mitigated by the
> HARDENED_USERCOPY kernel configuration.
> 
> The solution to these issues is to use scnprintf which returns the number
> of characters actually written to the buffer, so the size variable will
> never exceed SIZE.
> 
> Cc: Willy Tarreau <w@1wt.eu>
> Cc: Silvio Cesare <silvio.cesare@gmail.com>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>

Patch applied to ath-next branch of ath.git, thanks.

4b6e9f3fe1d8 ath9k: eeprom: Use scnprintf instead of snprintf

-- 
https://patchwork.kernel.org/patch/10765259/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches