Re: [PATCH v2] EDAC/mc_sysfs: Add missing newlines when printing {max,dimm}_location

[Borislav Petkov <bp@alien8.de>]

On Mon, Sep 14, 2020 at 10:48:54AM +0800, Xiongfeng Wang wrote:
> @@ -813,15 +817,21 @@ static ssize_t mci_max_location_show(struct device *dev,
>  				     char *data)
>  {
>  	struct mem_ctl_info *mci = to_mci(dev);
> -	int i;
> +	int i, n;
>  	char *p = data;
> +	unsigned int len = PAGE_SIZE;
>  
>  	for (i = 0; i < mci->n_layers; i++) {
> -		p += sprintf(p, "%s %d ",
> +		n = snprintf(p, len, "%s %d ",
>  			     edac_layer_name[mci->layers[i].type],
>  			     mci->layers[i].size - 1);
> +		p += n;
> +		len -= n;

What happens if that subtraction causes len to wrap around and become a
huge positive unsigned integer?

> +		if (!len)

Would that test still work?

IOW, I did this to your patch ontop. Note that I've moved the "p"
pointer incrementation after the length check so that the pointer
doesn't overflow too:

---
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index bf0e075fb635..fa0551c81e63 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -817,19 +817,22 @@ static ssize_t mci_max_location_show(struct device *dev,
 				     char *data)
 {
 	struct mem_ctl_info *mci = to_mci(dev);
-	int i, n;
+	int len = PAGE_SIZE;
 	char *p = data;
-	unsigned int len = PAGE_SIZE;
+	int i, n;
 
 	for (i = 0; i < mci->n_layers; i++) {
 		n = snprintf(p, len, "%s %d ",
 			     edac_layer_name[mci->layers[i].type],
 			     mci->layers[i].size - 1);
-		p += n;
+
 		len -= n;
-		if (!len)
+		if (len < 0)
 			goto out;
+
+		p += n;
 	}
+
 	p += snprintf(p, len, "\n");
 out:
 	return p - data;

-- 
Regards/Gruss,
    Boris.

https://people.kernel.org/tglx/notes-about-netiquette