From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 028343B4EB7; Tue, 21 Jul 2026 21:30:09 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784669411; cv=none; b=OEdNz1JsTzrRKb+duvklaArEbS9/X/f/vbgDAQd1U/UpnTwfvByEwSTYUjf4CkOeyeikWhzB/59lSFGRnW2/+U0Xr2gfyjHNvBwFfiQvBKFHWsZ/8AfFR3pJeAoJnsI+dRCLSSTU96/QTGsnnhtQknvcrRgQbik0FBWFo92F3Rg= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784669411; c=relaxed/simple; bh=4KlTAT6mrgJnjLU2KNx9zIzWV3ITeSE/StsHfc6Mfis=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=ovM2R2I59YeREYeDgDDxRU1Xc/mySO7E4OrxtbNvfHCbX3rttlCr6WqOkJF69tmoAu488YnYVqyE2OIxKpkFXyMGayr0ICysWDMX5hXXejepfcMN8HQIXonmIch1Z5Y0RvLjSraNnZKJUGLlL04YRuUNSMCjTrfAV+urctLyycI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=DU2UW+yL; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="DU2UW+yL" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 093631F000E9; Tue, 21 Jul 2026 21:30:08 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784669409; bh=60BM+bdtMmX0+PSul9kLG3AzAu1wHll/d3m877wliCM=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=DU2UW+yL+Vw1imsbV3JtOzfdy3JM4c4/C3aIMqaAnfKH4EPHt1+57UApJT6hXjw1A xxDltuMfHusbvMIEOAUHx4jlktBAnsI5YOkR/fZsxxYyawq8hHU7heUBluHhA9akOm mwpLb4NtBRZ89cQ0GH7PM24szgDMvW/169WqMFsc= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, sashiko-bot , Kan Liang , Arnaldo Carvalho de Melo , Sasha Levin Subject: [PATCH 6.1 0544/1067] tools lib api: Fix filename__write_int() writing uninitialized stack data Date: Tue, 21 Jul 2026 17:19:05 +0200 Message-ID: <20260721152436.780390378@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260721152424.521567757@linuxfoundation.org> References: <20260721152424.521567757@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Arnaldo Carvalho de Melo [ Upstream commit 438ece06185696e14c63c6113d5e2d34ec0a9680 ] filename__write_int() formats an integer into a 64-byte buffer with sprintf() then passes sizeof(buf) (64) as the write length. This writes all 64 bytes including uninitialized stack data past the formatted string. Most sysfs files reject the oversized write, making the function always return -1. Fix by capturing the sprintf() return value and using it as the write length. Reported-by: sashiko-bot Fixes: 3b00ea938653d136 ("tools lib api fs: Add sysfs__write_int function") Cc: Kan Liang Assisted-by: Claude:claude-opus-4.6 Signed-off-by: Arnaldo Carvalho de Melo Signed-off-by: Sasha Levin --- tools/lib/api/fs/fs.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/tools/lib/api/fs/fs.c b/tools/lib/api/fs/fs.c index e102714c6845e8..e13034cb0b6315 100644 --- a/tools/lib/api/fs/fs.c +++ b/tools/lib/api/fs/fs.c @@ -432,12 +432,13 @@ int filename__write_int(const char *filename, int value) { int fd = open(filename, O_WRONLY), err = -1; char buf[64]; + int len; if (fd < 0) return err; - sprintf(buf, "%d", value); - if (write(fd, buf, sizeof(buf)) == sizeof(buf)) + len = sprintf(buf, "%d", value); + if (write(fd, buf, len) == len) err = 0; close(fd); -- 2.53.0