From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mx0b-0031df01.pphosted.com (mx0b-0031df01.pphosted.com [205.220.180.131]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38D461DC985 for ; Sat, 18 Jul 2026 22:00:58 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=205.220.180.131 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784412060; cv=none; b=dQmpfp1uoPZTK8nfifdOqgPKXFjWifNOKhga+9qeODVeenrulTLaG7RoNLh5R51UgOm/R51Gmc+YuqoKTx5gE6+4ari7CPi/CDp7MOt3vhr1ntdPKPj0DjHpcVOHjWmSJnbUGzLHn9YhPWPZsM8Q6COCD2hR/qXKqjJpaedVcCk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784412060; c=relaxed/simple; bh=ghYlqvLKt0/cMTVKqnu8zwIKwlK0pqI+GKZep1Vvynk=; h=Date:From:To:Cc:Subject:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=PWSpqgx8Ae+7s0egSj5FiiXXLwuvCdnnHd920VNiyLE13312gQ7LuUpy77NXaYjk1rAmMIEvjgjnpOTorN3UreAPgAnE66pXNMBlfR19weR+4Dn7kcHqov+ebu1my09Wr0dfZxFiGUJeVY7Tk0f2RX1WmCGfI+NGc/FnG8S8Uz0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com; spf=pass smtp.mailfrom=oss.qualcomm.com; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b=REAVnpkM; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b=TPjuT2nz; arc=none smtp.client-ip=205.220.180.131 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=oss.qualcomm.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=qualcomm.com header.i=@qualcomm.com header.b="REAVnpkM"; dkim=pass (2048-bit key) header.d=oss.qualcomm.com header.i=@oss.qualcomm.com header.b="TPjuT2nz" Received: from pps.filterd (m0279869.ppops.net [127.0.0.1]) by mx0a-0031df01.pphosted.com (8.18.1.11/8.18.1.11) with ESMTP id 66IJpuxg1687162 for ; Sat, 18 Jul 2026 22:00:57 GMT DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=qualcomm.com; h= cc:content-transfer-encoding:content-type:date:from:in-reply-to :message-id:mime-version:references:subject:to; s=qcppdkim1; bh= Miz8KGebrcURqqzxwczxNO7UgR0aqbaEZxfBca1IrQw=; b=REAVnpkMis9qKOoQ Gjsg3K/o2M+DcLAkQNK2M9MPuds+uaJSjVTVguT35oRyu+fno46B/wavhqArWifG SyaziYAj+/noPOtUL+yEFZ8xIJKYRYZUl271IuRLHJgi8g+Qg+ydOjXZPRxrgqXQ JdATzhyxivmaASMRX59fQpoVBVNTYlAZtIUjXE/DwFqkJG13ov/i0MIGGZnDeYkz mAtThmPEVQMpubPv72LbqdCKiomm1AMjsnSSpeYmNcYOfvndpybO/LomC/L+nb1+ Vdsk5WHoMi6T3GZNKFi9hlugV7J5+ssubL1zr48lP4ic1tGFU6jabD2tI4owVTSp lbeF6g== Received: from mail-pg1-f199.google.com (mail-pg1-f199.google.com [209.85.215.199]) by mx0a-0031df01.pphosted.com (PPS) with ESMTPS id 4fg2c69nb8-1 (version=TLSv1.3 cipher=TLS_AES_128_GCM_SHA256 bits=128 verify=NOT) for ; Sat, 18 Jul 2026 22:00:56 +0000 (GMT) Received: by mail-pg1-f199.google.com with SMTP id 41be03b00d2f7-ca124bf0189so1683924a12.0 for ; Sat, 18 Jul 2026 15:00:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=oss.qualcomm.com; s=google; t=1784412056; x=1785016856; darn=vger.kernel.org; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:from:to:cc:subject :date:message-id:reply-to:content-type; bh=Miz8KGebrcURqqzxwczxNO7UgR0aqbaEZxfBca1IrQw=; b=TPjuT2nzVNWfr/c/yn4vJhhhS9SCUSbc2UTOIfHatbF6mmh09iAujJU5cIM4HJthnQ SxOevXFTAWFSVB5zSCWKiXf8a0EuHTVTFHEEXuTfIK7jjWklAN6l1QmONV7epDgkGO/x NOfWUKVypHlC3VKkS/Nilw8QRjYVVGur+MXHyuS5BbF7YLyv7ItGsPQWcX1s663FrMAK jQZcGsSUN37W+3WXAn83Lj+8TrhItw/ghVg6OS2PtHAtIfiewowZynvhmpl6QTx33CBy t6it3puR7eIsOQDQ8Px0b9RrrPIUmm9cjWsQmpJ1d/dadkiqVwIUQKGw6QJy1Hclx3UR Sutw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784412056; x=1785016856; h=content-transfer-encoding:content-type:mime-version:references :in-reply-to:message-id:subject:cc:to:from:date:x-gm-gg :x-gm-message-state:from:to:cc:subject:date:message-id:reply-to :content-type; bh=Miz8KGebrcURqqzxwczxNO7UgR0aqbaEZxfBca1IrQw=; b=PcrTkFiHq/ue96FIMWJ85yPI5U54hwFjTsgStgGyZQfMc8JnRIF7lgGDFB4z0gtt2Q RiXFjd4Y45EU07oZEL24uIEKnDaaaxNaTrklGY+Cr+JP5SvTssY6Ab4KVmPtdwOqISlK m8DDWx7WLroovsLcb3nE57SQc1stpOb660xf1ORY/VLV9edCiHsAgXzMKj3exs6rdrCi LC8++Q5aogeMdYMIiYEbLW1o8Sb6UuwAdBCUesO/zHMYno8izHNi5lo7voIaRCd03QwA xYz1Y8LhIuKqktEosCi0v1QaYs/GK712vEOmfm/IsBVNKYtiWu3VB45Oid2tmUvcZTMh k7eQ== X-Forwarded-Encrypted: i=1; AHgh+RpO56mz9Xcmlf+mD5xW2jtzvzhJJzFIR0ZNwPLSoVRf+wq7GwNkAxXkKQObNeA2B1CiSWMVP7zkoCin7I8=@vger.kernel.org X-Gm-Message-State: AOJu0YwRaRfxRsXzkBg3/E3W6SixNj+T/ybJWkBHrh1VvPfxZyz3n/e8 Q5bJYNAkW27bw6w1NaT7TTj9TAf8VJqNp4grjI4r9R0QqS4YZuqYVCNMdhp9nVReda0VMy5FwCO i0cGCRvqoeG+sqIwl8/YuF7M7FrfpyRkItnuibJDtJudvCtTkp0IfF0ClQrZASmnPDt0= X-Gm-Gg: AfdE7cm8f3JP5amrN/0hoJbZyd0X9RLCwhDoS2s0Wi2TmazEpe4j23EVcXLuZqSPoEz 549phSQxCuJAxdTLixB7jcHOKYUHtifeBVwad2oFXLgOs74xE30KcX/UIdW5AStOBTKMOir28ms G9pK8eyH7CC8rX7PGxzEJ/dx1ZKu6ClNQKjlGHbvk2mr17hBtvkwshKSqLgbf9V3KyO4wAqz2wX vxvgESqbFqJnZpcnjugfrDjv65xxJ99l43V7EGYPX0eEBUSFkeqaI3O74TXweYosSK8z/4aU9UV U/4Hhws3cZHHWVJ7m4HdtxRWOjblNnPAOoZNMnEkH7YT+nByvGx2nWjTjHwIzCODURmMLSHjg0n rpAlwrYdgDOAdphdU X-Received: by 2002:a05:6a20:a11b:b0:3b5:530d:d96d with SMTP id adf61e73a8af0-3c3acc978dcmr8272366637.12.1784412055820; Sat, 18 Jul 2026 15:00:55 -0700 (PDT) X-Received: by 2002:a05:6a20:a11b:b0:3b5:530d:d96d with SMTP id adf61e73a8af0-3c3acc978dcmr8272322637.12.1784412055316; Sat, 18 Jul 2026 15:00:55 -0700 (PDT) Received: from jic23-huawei ([50.35.46.84]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cb517aad770sm2391073a12.2.2026.07.18.15.00.53 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 18 Jul 2026 15:00:54 -0700 (PDT) Date: Sat, 18 Jul 2026 23:00:50 +0100 From: Jonathan Cameron To: Babanpreet Singh Cc: Nuno =?UTF-8?B?U8Oh?= , Michael Hennerich , David Lechner , Andy Shevchenko , Andy Shevchenko , Angelo Dureghello , linux@analog.com, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH v3] iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show Message-ID: <20260718230050.2c64d9fa@jic23-huawei> In-Reply-To: <20260718182236.7-1-bbnpreetsingh@gmail.com> References: <20260718182236.7-1-bbnpreetsingh@gmail.com> X-Mailer: Claws Mail 4.4.0 (GTK 3.24.52; x86_64-pc-linux-gnu) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-Proofpoint-GUID: gP1gZgQ372rTfoTjWFkaxO4bru9HnSHN X-Proofpoint-Spam-Details-Enc: AW1haW4tMjYwNzE4MDIzMSBTYWx0ZWRfXzWd2YtTsSTjL LREkF/fr6hrL9sheqIn5JjZrSvl0di7TH3gOL9uKNM4OUStiYNa5KNjTN6xmuQG4LH5qp/XAT4Z i2pq2oeaigxEcZ5USECq4M2DLHiBJDXCJ2x0ezJJST3ZRUBwWhJ8lVewf+xUFvruMOR1ERQe+gu Hm63kpb7xyKptpH19vavP2ntE26qfxcbgzZHqUl4oJT6FJZacUN4j+m9aDGjTnTXIoHK4setlvv /KEgV7GIAXmNU1P03LRsJ2cjHy6DthpmNtLky5RbxavjSL0uYRz5E9kfH6PbEQ83BmVJKtRV/zm /Fvq63L4bm82+5jA5LVIC8Tdu7W80nNlGzgnZkjIAAQCMfgULmXvYRkolqJtJGvpFN+BLz/0V6z tLOZ+4ca7GzXgc5aVJoDfy3WuTz9gm1ATMBMSiQrhs/5hkVC6Wv1m52nGp/PdtRhwKB2eqiuflA sK+bLib4gk8XPgRopdw== X-Proofpoint-ORIG-GUID: gP1gZgQ372rTfoTjWFkaxO4bru9HnSHN X-Proofpoint-Spam-Info: AW1haW4tMjYwNzE4MDIzMSBTYWx0ZWRfX6rrlkw4m6uow H5bnNE36Yrek6Gtbbkx9sDTBdyE7bJFIfX4fL0pUskOTxfI3iTK/g1M4veCxfiJ5Z9mVT5J7ygE yGu3dIzclWhu/VpJ3H6J7KXi5Tzin4k= X-Authority-Analysis: v=2.4 cv=CJQamxrD c=1 sm=1 tr=0 ts=6a5bf798 cx=c_pps a=Oh5Dbbf/trHjhBongsHeRQ==:117 a=qC1CW/w66vtJz1P9yTJxNA==:17 a=kj9zAlcOel0A:10 a=RAioF0-LDSMA:10 a=s4-Qcg_JpJYA:10 a=VkNPw1HP01LnGYTKEx00:22 a=u7WPNUs3qKkmUXheDGA7:22 a=_glEPmIy2e8OvE2BGh3C:22 a=VwQbUJbxAAAA:8 a=pGLkceISAAAA:8 a=d46Ztn4Rf3i8j93KB0cA:9 a=CjuIK1q_8ugA:10 a=_Vgx9l1VpLgwpw_dHYaR:22 X-Proofpoint-Virus-Version: vendor=baseguard engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.134,FMLib:17.12.100.49 definitions=2026-07-18_06,2026-07-17_01,2025-10-01_01 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 bulkscore=0 adultscore=0 impostorscore=0 lowpriorityscore=0 malwarescore=0 suspectscore=0 phishscore=0 priorityscore=1501 spamscore=0 clxscore=1015 classifier=typeunknown authscore=0 authtc= authcc= route=outbound adjust=0 reason=mlx scancount=1 engine=8.22.0-2606150000 definitions=main-2607180231 On Sat, 18 Jul 2026 18:22:36 +0000 Babanpreet Singh wrote: > ad3552r_hs_show_data_source_avail() formats the available data source > names into a 128-byte stack buffer, but bounds each scnprintf() with > PAGE_SIZE instead of the buffer size, so the bound does not protect > the destination at all. > > This cannot overflow today - dbgfs_attr_source[] has two entries, > "normal" and "ramp-16bit", 18 bytes formatted - but the bound stops > protecting the stack the day the table grows. Use sizeof(buf) so the > bound matches the destination. > > Found by smatch: > > drivers/iio/dac/ad3552r-hs.c:593 ad3552r_hs_show_data_source_avail() > error: scnprintf() 'buf[len]' too small (128 vs 4096) > > Fixes: b1c5d68ea66e ("iio: dac: ad3552r-hs: add support for internal ramp") > Assisted-by: Claude:claude-sonnet-5 > Signed-off-by: Babanpreet Singh Applied to the fixes-togreg branch of iio.git and marked for stable. Thanks, Jonathan > --- > v3: > - Return to the v1 fix: bound scnprintf() with sizeof(buf) instead > of switching to sysfs_emit_at(). As Andy noticed in the v2 review, > this is a custom debugfs read handler formatting a kernel buffer > for simple_read_from_buffer(), not a sysfs show callback, so > sysfs_emit_at() does not apply here: > https://lore.kernel.org/r/als6lRi-H4DM7ra6@ashevche-desk.local > - Dropped Suggested-by and restored the v1 title; the diff is > identical to v1. > > v2: https://lore.kernel.org/r/20260718044244.7-1-bbnpreetsingh@gmail.com > v1: https://lore.kernel.org/r/20260717040024.7-1-bbnpreetsingh@gmail.com > > drivers/iio/dac/ad3552r-hs.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/iio/dac/ad3552r-hs.c b/drivers/iio/dac/ad3552r-hs.c > index 02a124ac4855..f865843aa439 100644 > --- a/drivers/iio/dac/ad3552r-hs.c > +++ b/drivers/iio/dac/ad3552r-hs.c > @@ -590,7 +590,7 @@ static ssize_t ad3552r_hs_show_data_source_avail(struct file *f, > int i; > > for (i = 0; i < ARRAY_SIZE(dbgfs_attr_source); i++) { > - len += scnprintf(buf + len, PAGE_SIZE - len, "%s ", > + len += scnprintf(buf + len, sizeof(buf) - len, "%s ", > dbgfs_attr_source[i]); > } > buf[len - 1] = '\n'; > > base-commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a