From: Guenter Roeck <linux@roeck-us.net>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Ugur Usug <Ugur.Usug@maximintegrated.com>,
Jean Delvare <jdelvare@suse.com>,
linux-hwmon@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] hwmon: (pmbus/max20730) use scnprintf() instead of snprintf()
Date: Fri, 23 Oct 2020 21:15:09 +0000 [thread overview]
Message-ID: <20201023211509.GA28238@roeck-us.net> (raw)
In-Reply-To: <20201022070824.GC2817762@mwanda>
On Thu, Oct 22, 2020 at 10:08:24AM +0300, Dan Carpenter wrote:
> The snprintf() function returns the number of characters which would
> have been printed if there were enough space, but the scnprintf()
> returns the number of characters which were actually printed. If the
> buffer is not large enough, then using snprintf() would result in a
> read overflow and an information leak.
>
> Fixes: 8910c0bd533d ("hwmon: (pmbus/max20730) add device monitoring via debugfs")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied.
Thanks,
Guenter
> ---
> drivers/hwmon/pmbus/max20730.c | 26 +++++++++++++-------------
> 1 file changed, 13 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/hwmon/pmbus/max20730.c b/drivers/hwmon/pmbus/max20730.c
> index 57923d72490c..be83b98411c7 100644
> --- a/drivers/hwmon/pmbus/max20730.c
> +++ b/drivers/hwmon/pmbus/max20730.c
> @@ -122,8 +122,8 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> switch (idx) {
> case MAX20730_DEBUGFS_VOUT_MIN:
> ret = VOLT_FROM_REG(data->mfr_voutmin * 10000);
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d.%d\n",
> - ret / 10000, ret % 10000);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d.%d\n",
> + ret / 10000, ret % 10000);
> break;
> case MAX20730_DEBUGFS_FREQUENCY:
> val = (data->mfr_devset1 & MAX20730_MFR_DEVSET1_FSW_MASK)
> @@ -141,7 +141,7 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> ret = 800;
> else
> ret = 900;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_PG_DELAY:
> val = (data->mfr_devset1 & MAX20730_MFR_DEVSET1_TSTAT_MASK)
> @@ -223,7 +223,7 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> case MAX20730_DEBUGFS_OC_PROTECT_MODE:
> ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_OCPM_MASK)
> >> MAX20730_MFR_DEVSET2_OCPM_BIT_POS;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_SS_TIMING:
> val = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_SS_MASK)
> @@ -241,32 +241,32 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> case MAX20730_DEBUGFS_IMAX:
> ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_IMAX_MASK)
> >> MAX20730_MFR_DEVSET2_IMAX_BIT_POS;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_OPERATION:
> ret = i2c_smbus_read_byte_data(psu->client, PMBUS_OPERATION);
> if (ret < 0)
> return ret;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_ON_OFF_CONFIG:
> ret = i2c_smbus_read_byte_data(psu->client, PMBUS_ON_OFF_CONFIG);
> if (ret < 0)
> return ret;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_SMBALERT_MASK:
> ret = i2c_smbus_read_word_data(psu->client,
> PMBUS_SMB_ALERT_MASK);
> if (ret < 0)
> return ret;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_VOUT_MODE:
> ret = i2c_smbus_read_byte_data(psu->client, PMBUS_VOUT_MODE);
> if (ret < 0)
> return ret;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_VOUT_COMMAND:
> ret = i2c_smbus_read_word_data(psu->client, PMBUS_VOUT_COMMAND);
> @@ -274,8 +274,8 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> return ret;
>
> ret = VOLT_FROM_REG(ret * 10000);
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX,
> - "%d.%d\n", ret / 10000, ret % 10000);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX,
> + "%d.%d\n", ret / 10000, ret % 10000);
> break;
> case MAX20730_DEBUGFS_VOUT_MAX:
> ret = i2c_smbus_read_word_data(psu->client, PMBUS_VOUT_MAX);
> @@ -283,8 +283,8 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> return ret;
>
> ret = VOLT_FROM_REG(ret * 10000);
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX,
> - "%d.%d\n", ret / 10000, ret % 10000);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX,
> + "%d.%d\n", ret / 10000, ret % 10000);
> break;
> default:
> len = strlcpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
WARNING: multiple messages have this Message-ID (diff)
From: Guenter Roeck <linux@roeck-us.net>
To: Dan Carpenter <dan.carpenter@oracle.com>
Cc: Ugur Usug <Ugur.Usug@maximintegrated.com>,
Jean Delvare <jdelvare@suse.com>,
linux-hwmon@vger.kernel.org, kernel-janitors@vger.kernel.org
Subject: Re: [PATCH] hwmon: (pmbus/max20730) use scnprintf() instead of snprintf()
Date: Fri, 23 Oct 2020 14:15:09 -0700 [thread overview]
Message-ID: <20201023211509.GA28238@roeck-us.net> (raw)
In-Reply-To: <20201022070824.GC2817762@mwanda>
On Thu, Oct 22, 2020 at 10:08:24AM +0300, Dan Carpenter wrote:
> The snprintf() function returns the number of characters which would
> have been printed if there were enough space, but the scnprintf()
> returns the number of characters which were actually printed. If the
> buffer is not large enough, then using snprintf() would result in a
> read overflow and an information leak.
>
> Fixes: 8910c0bd533d ("hwmon: (pmbus/max20730) add device monitoring via debugfs")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Applied.
Thanks,
Guenter
> ---
> drivers/hwmon/pmbus/max20730.c | 26 +++++++++++++-------------
> 1 file changed, 13 insertions(+), 13 deletions(-)
>
> diff --git a/drivers/hwmon/pmbus/max20730.c b/drivers/hwmon/pmbus/max20730.c
> index 57923d72490c..be83b98411c7 100644
> --- a/drivers/hwmon/pmbus/max20730.c
> +++ b/drivers/hwmon/pmbus/max20730.c
> @@ -122,8 +122,8 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> switch (idx) {
> case MAX20730_DEBUGFS_VOUT_MIN:
> ret = VOLT_FROM_REG(data->mfr_voutmin * 10000);
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d.%d\n",
> - ret / 10000, ret % 10000);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d.%d\n",
> + ret / 10000, ret % 10000);
> break;
> case MAX20730_DEBUGFS_FREQUENCY:
> val = (data->mfr_devset1 & MAX20730_MFR_DEVSET1_FSW_MASK)
> @@ -141,7 +141,7 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> ret = 800;
> else
> ret = 900;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_PG_DELAY:
> val = (data->mfr_devset1 & MAX20730_MFR_DEVSET1_TSTAT_MASK)
> @@ -223,7 +223,7 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> case MAX20730_DEBUGFS_OC_PROTECT_MODE:
> ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_OCPM_MASK)
> >> MAX20730_MFR_DEVSET2_OCPM_BIT_POS;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_SS_TIMING:
> val = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_SS_MASK)
> @@ -241,32 +241,32 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> case MAX20730_DEBUGFS_IMAX:
> ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_IMAX_MASK)
> >> MAX20730_MFR_DEVSET2_IMAX_BIT_POS;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_OPERATION:
> ret = i2c_smbus_read_byte_data(psu->client, PMBUS_OPERATION);
> if (ret < 0)
> return ret;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_ON_OFF_CONFIG:
> ret = i2c_smbus_read_byte_data(psu->client, PMBUS_ON_OFF_CONFIG);
> if (ret < 0)
> return ret;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_SMBALERT_MASK:
> ret = i2c_smbus_read_word_data(psu->client,
> PMBUS_SMB_ALERT_MASK);
> if (ret < 0)
> return ret;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_VOUT_MODE:
> ret = i2c_smbus_read_byte_data(psu->client, PMBUS_VOUT_MODE);
> if (ret < 0)
> return ret;
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);
> break;
> case MAX20730_DEBUGFS_VOUT_COMMAND:
> ret = i2c_smbus_read_word_data(psu->client, PMBUS_VOUT_COMMAND);
> @@ -274,8 +274,8 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> return ret;
>
> ret = VOLT_FROM_REG(ret * 10000);
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX,
> - "%d.%d\n", ret / 10000, ret % 10000);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX,
> + "%d.%d\n", ret / 10000, ret % 10000);
> break;
> case MAX20730_DEBUGFS_VOUT_MAX:
> ret = i2c_smbus_read_word_data(psu->client, PMBUS_VOUT_MAX);
> @@ -283,8 +283,8 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf,
> return ret;
>
> ret = VOLT_FROM_REG(ret * 10000);
> - len = snprintf(tbuf, DEBUG_FS_DATA_MAX,
> - "%d.%d\n", ret / 10000, ret % 10000);
> + len = scnprintf(tbuf, DEBUG_FS_DATA_MAX,
> + "%d.%d\n", ret / 10000, ret % 10000);
> break;
> default:
> len = strlcpy(tbuf, "Invalid\n", DEBUG_FS_DATA_MAX);
next prev parent reply other threads:[~2020-10-23 21:15 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-10-22 7:08 [PATCH] hwmon: (pmbus/max20730) use scnprintf() instead of snprintf() Dan Carpenter
2020-10-22 7:08 ` Dan Carpenter
2020-10-23 21:15 ` Guenter Roeck [this message]
2020-10-23 21:15 ` Guenter Roeck
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20201023211509.GA28238@roeck-us.net \
--to=linux@roeck-us.net \
--cc=Ugur.Usug@maximintegrated.com \
--cc=dan.carpenter@oracle.com \
--cc=jdelvare@suse.com \
--cc=kernel-janitors@vger.kernel.org \
--cc=linux-hwmon@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.