Re: [PATCH] staging: gpib: avoid buffer overflow

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, Oct 15, 2024 at 08:38:13PM +0200, Kees Bakker wrote:
> The remaining buffer size for snprintf also depends on `pos`.
> 
> Signed-off-by: Kees Bakker <kees@ijzerbout.nl>
> ---
>  drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> index 1da263676f2a..4df1ceaa138f 100644
> --- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> +++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> @@ -364,7 +364,7 @@ static void ni_usb_dump_raw_block(const u8 *raw_data, int length)
>  			pr_info("%s\n", print_buf);
>  			pos = 0;
>  		}
> -		pos += snprintf(&print_buf[pos], RAW_BUF_SIZE, " %02x", raw_data[i]);
> +		pos += snprintf(&print_buf[pos], RAW_BUF_SIZE - pos, " %02x", raw_data[i]);
>  	}
>  	if (pos)
>  		pr_info("%s\n", print_buf);

The better thing to do would be to delete this whole function and just
use the in-kernel hex_dump_to_buffer() function instead, which handles
all of this logic properly.

Can you do that instead?

thanks,

greg k-h