[PATCH v1 1/1] Input: lifebook - bail out when device path can't fit buffer

[PATCH v1 1/1] Input: lifebook - bail out when device path can't fit buffer

[Andy Shevchenko]

When creating a physical device name in the driver the snprintf() takes
an up to 32 characters argument along with the additional 8 characters
and tries to pack this into 32 bytes array. GCC complains about that
when build with `make W=1`:

drivers/input/mouse/lifebook.c:282:9: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
 282 |         snprintf(priv->phys, sizeof(priv->phys),
     |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 283 |                  "%s/input1", psmouse->ps2dev.serio->phys);
     |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix these by checking for the potential overflow.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/input/mouse/lifebook.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/drivers/input/mouse/lifebook.c b/drivers/input/mouse/lifebook.c
index 7147dacc404f..58df2c0e53cb 100644
--- a/drivers/input/mouse/lifebook.c
+++ b/drivers/input/mouse/lifebook.c
@@ -272,6 +272,7 @@ static int lifebook_create_relative_device(struct psmouse *psmouse)
 	struct input_dev *dev2;
 	struct lifebook_data *priv;
 	int error = -ENOMEM;
+	int n;
 
 	priv = kzalloc(sizeof(*priv), GFP_KERNEL);
 	dev2 = input_allocate_device();
@@ -279,8 +280,13 @@ static int lifebook_create_relative_device(struct psmouse *psmouse)
 		goto err_out;
 
 	priv->dev2 = dev2;
-	snprintf(priv->phys, sizeof(priv->phys),
-		 "%s/input1", psmouse->ps2dev.serio->phys);
+
+	n = snprintf(priv->phys, sizeof(priv->phys),
+		     "%s/input1", psmouse->ps2dev.serio->phys);
+	if (n >= sizeof(priv->phys)) {
+		error = -E2BIG;
+		goto err_out;
+	}
 
 	dev2->phys = priv->phys;
 	dev2->name = "LBPS/2 Fujitsu Lifebook Touchpad";
-- 
2.47.2