[PATCH v2] iio: dac: ad3552r-hs: use sysfs_emit_at() in data source avail show

[PATCH v2] iio: dac: ad3552r-hs: use sysfs_emit_at() in data source avail show

[Babanpreet Singh]

ad3552r_hs_show_data_source_avail() formats the available data source
names into a 128-byte stack buffer, but bounds each scnprintf() with
PAGE_SIZE instead of the buffer size, so the bound does not protect
the destination at all.

This cannot overflow today - dbgfs_attr_source[] has two entries,
"normal" and "ramp-16bit", 18 bytes formatted - but the bound stops
protecting the stack the day the table grows.

Found by smatch:

  drivers/iio/dac/ad3552r-hs.c:593 ad3552r_hs_show_data_source_avail()
  error: scnprintf() 'buf[len]' too small (128 vs 4096)

Instead of shrinking the scnprintf() bound to the buffer size, switch
to sysfs_emit_at(), which enforces the PAGE_SIZE bound internally and
is the preferred helper for formatting attribute-style output; the IIO
core formats its own avail lists the same way in iio_format_list().
sysfs_emit_at() refuses buffers that are not page-aligned, so replace
the stack buffer with a kzalloc()'d page - power-of-two kmalloc()
allocations are naturally aligned, see
Documentation/core-api/memory-allocation.rst.

Fixes: b1c5d68ea66e ("iio: dac: ad3552r-hs: add support for internal ramp")
Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>
Assisted-by: claude-sonnet-5
Signed-off-by: Babanpreet Singh <bbnpreetsingh@gmail.com>
---
v2:
 - Switch to sysfs_emit_at() with a kzalloc()'d page instead of
   bounding scnprintf() with sizeof(buf), as suggested by Andy
   Shevchenko. sysfs_emit_at() requires a page-aligned buffer, so
   the 128-byte stack buffer cannot stay; add the cleanup.h, slab.h
   and sysfs.h includes the new code needs.
 - Retitled; v1 was "iio: dac: ad3552r-hs: fix scnprintf() buffer
   bound in data source show".

v1: https://lore.kernel.org/r/20260717040024.7-1-bbnpreetsingh@gmail.com

 drivers/iio/dac/ad3552r-hs.c | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

diff --git a/drivers/iio/dac/ad3552r-hs.c b/drivers/iio/dac/ad3552r-hs.c
index 02a124ac4855..c561fed2ef1a 100644
--- a/drivers/iio/dac/ad3552r-hs.c
+++ b/drivers/iio/dac/ad3552r-hs.c
@@ -7,6 +7,7 @@
  */
 
 #include <linux/bitfield.h>
+#include <linux/cleanup.h>
 #include <linux/debugfs.h>
 #include <linux/delay.h>
 #include <linux/gpio/consumer.h>
@@ -14,6 +15,8 @@
 #include <linux/iio/buffer.h>
 #include <linux/platform_device.h>
 #include <linux/property.h>
+#include <linux/slab.h>
+#include <linux/sysfs.h>
 #include <linux/units.h>
 
 #include "ad3552r.h"
@@ -585,14 +588,15 @@ static ssize_t ad3552r_hs_show_data_source_avail(struct file *f,
 						 char __user *userbuf,
 						 size_t count, loff_t *ppos)
 {
-	ssize_t len = 0;
-	char buf[128];
+	char *buf __free(kfree) = kzalloc(PAGE_SIZE, GFP_KERNEL);
+	int len = 0;
 	int i;
 
-	for (i = 0; i < ARRAY_SIZE(dbgfs_attr_source); i++) {
-		len += scnprintf(buf + len, PAGE_SIZE - len, "%s ",
-				 dbgfs_attr_source[i]);
-	}
+	if (!buf)
+		return -ENOMEM;
+
+	for (i = 0; i < ARRAY_SIZE(dbgfs_attr_source); i++)
+		len += sysfs_emit_at(buf, len, "%s ", dbgfs_attr_source[i]);
 	buf[len - 1] = '\n';
 
 	return simple_read_from_buffer(userbuf, count, ppos, buf, len);

base-commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a
-- 
2.43.0

Re: [PATCH v2] iio: dac: ad3552r-hs: use sysfs_emit_at() in data source avail show

[Andy Shevchenko]

On Sat, Jul 18, 2026 at 04:42:44AM +0000, Babanpreet Singh wrote:
> ad3552r_hs_show_data_source_avail() formats the available data source
> names into a 128-byte stack buffer, but bounds each scnprintf() with
> PAGE_SIZE instead of the buffer size, so the bound does not protect
> the destination at all.
> 
> This cannot overflow today - dbgfs_attr_source[] has two entries,
> "normal" and "ramp-16bit", 18 bytes formatted - but the bound stops
> protecting the stack the day the table grows.
> 
> Found by smatch:
> 
>   drivers/iio/dac/ad3552r-hs.c:593 ad3552r_hs_show_data_source_avail()
>   error: scnprintf() 'buf[len]' too small (128 vs 4096)

> Fixes: b1c5d68ea66e ("iio: dac: ad3552r-hs: add support for internal ramp")
> Suggested-by: Andy Shevchenko <andriy.shevchenko@intel.com>

This whole thing is not what I suggested, I only had an idea of using
sysfs_emit_at(). BUT...

...

> static ssize_t ad3552r_hs_show_data_source_avail(struct file *f,
>  						 char __user *userbuf,

...I haven't paid attention that this is not sysfs attribute handling
in the default way, this is customized one and the passed buffer is
in user space.

>  						 size_t count, loff_t *ppos)

Hence the correct fix is just replace PAGE_SIZE with sizeof(buf) as it was
I suppose in v1. Sorry for my mistake.

-- 
With Best Regards,
Andy Shevchenko