* Re: [PATCH] staging: gpib: avoid buffer overflow
[not found] <20241015201629.4B97918DA87@bout3.ijzerbout.nl>
@ 2024-10-17 9:44 ` Dave Penkler
0 siblings, 0 replies; 4+ messages in thread
From: Dave Penkler @ 2024-10-17 9:44 UTC (permalink / raw)
To: Kees Bakker; +Cc: Greg Kroah-Hartman, linux-staging
Hi Kees,
On Tue, Oct 15, 2024 at 08:38:13PM +0200, Kees Bakker wrote:
> The remaining buffer size for snprintf also depends on `pos`.
>
> Signed-off-by: Kees Bakker <kees@ijzerbout.nl>
> ---
> drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> index 1da263676f2a..4df1ceaa138f 100644
> --- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> +++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> @@ -364,7 +364,7 @@ static void ni_usb_dump_raw_block(const u8 *raw_data, int length)
> pr_info("%s\n", print_buf);
> pos = 0;
> }
> - pos += snprintf(&print_buf[pos], RAW_BUF_SIZE, " %02x", raw_data[i]);
> + pos += snprintf(&print_buf[pos], RAW_BUF_SIZE - pos, " %02x", raw_data[i]);
> }
> if (pos)
> pr_info("%s\n", print_buf);
> --
> 2.47.0
>
Thanks.
Please copy the <linux-staging@lists.linux.dev> mailing list.
Can you do this also for agilent_82357a.c
-Dave
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH] staging: gpib: avoid buffer overflow
@ 2024-10-15 18:38 Kees Bakker
2024-10-17 18:23 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Kees Bakker @ 2024-10-15 18:38 UTC (permalink / raw)
To: Dave Penkler, Linux Staging
The remaining buffer size for snprintf also depends on `pos`.
Signed-off-by: Kees Bakker <kees@ijzerbout.nl>
---
drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
index 1da263676f2a..4df1ceaa138f 100644
--- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
+++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
@@ -364,7 +364,7 @@ static void ni_usb_dump_raw_block(const u8 *raw_data, int length)
pr_info("%s\n", print_buf);
pos = 0;
}
- pos += snprintf(&print_buf[pos], RAW_BUF_SIZE, " %02x", raw_data[i]);
+ pos += snprintf(&print_buf[pos], RAW_BUF_SIZE - pos, " %02x", raw_data[i]);
}
if (pos)
pr_info("%s\n", print_buf);
--
2.47.0
^ permalink raw reply related [flat|nested] 4+ messages in thread* Re: [PATCH] staging: gpib: avoid buffer overflow
2024-10-15 18:38 Kees Bakker
@ 2024-10-17 18:23 ` Greg KH
2024-10-17 18:24 ` Greg KH
0 siblings, 1 reply; 4+ messages in thread
From: Greg KH @ 2024-10-17 18:23 UTC (permalink / raw)
To: Kees Bakker; +Cc: Dave Penkler, Linux Staging
On Tue, Oct 15, 2024 at 08:38:13PM +0200, Kees Bakker wrote:
> The remaining buffer size for snprintf also depends on `pos`.
>
> Signed-off-by: Kees Bakker <kees@ijzerbout.nl>
> ---
> drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> index 1da263676f2a..4df1ceaa138f 100644
> --- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> +++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> @@ -364,7 +364,7 @@ static void ni_usb_dump_raw_block(const u8 *raw_data, int length)
> pr_info("%s\n", print_buf);
> pos = 0;
> }
> - pos += snprintf(&print_buf[pos], RAW_BUF_SIZE, " %02x", raw_data[i]);
> + pos += snprintf(&print_buf[pos], RAW_BUF_SIZE - pos, " %02x", raw_data[i]);
> }
> if (pos)
> pr_info("%s\n", print_buf);
The better thing to do would be to delete this whole function and just
use the in-kernel hex_dump_to_buffer() function instead, which handles
all of this logic properly.
Can you do that instead?
thanks,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread* Re: [PATCH] staging: gpib: avoid buffer overflow
2024-10-17 18:23 ` Greg KH
@ 2024-10-17 18:24 ` Greg KH
0 siblings, 0 replies; 4+ messages in thread
From: Greg KH @ 2024-10-17 18:24 UTC (permalink / raw)
To: Kees Bakker; +Cc: Dave Penkler, Linux Staging
On Thu, Oct 17, 2024 at 08:23:25PM +0200, Greg KH wrote:
> On Tue, Oct 15, 2024 at 08:38:13PM +0200, Kees Bakker wrote:
> > The remaining buffer size for snprintf also depends on `pos`.
> >
> > Signed-off-by: Kees Bakker <kees@ijzerbout.nl>
> > ---
> > drivers/staging/gpib/ni_usb/ni_usb_gpib.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> > index 1da263676f2a..4df1ceaa138f 100644
> > --- a/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> > +++ b/drivers/staging/gpib/ni_usb/ni_usb_gpib.c
> > @@ -364,7 +364,7 @@ static void ni_usb_dump_raw_block(const u8 *raw_data, int length)
> > pr_info("%s\n", print_buf);
> > pos = 0;
> > }
> > - pos += snprintf(&print_buf[pos], RAW_BUF_SIZE, " %02x", raw_data[i]);
> > + pos += snprintf(&print_buf[pos], RAW_BUF_SIZE - pos, " %02x", raw_data[i]);
> > }
> > if (pos)
> > pr_info("%s\n", print_buf);
>
> The better thing to do would be to delete this whole function and just
> use the in-kernel hex_dump_to_buffer() function instead, which handles
> all of this logic properly.
>
> Can you do that instead?
Oops, I mean print_hex_dump().
thanks,
greg k-h
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2024-10-17 18:24 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
[not found] <20241015201629.4B97918DA87@bout3.ijzerbout.nl>
2024-10-17 9:44 ` [PATCH] staging: gpib: avoid buffer overflow Dave Penkler
2024-10-15 18:38 Kees Bakker
2024-10-17 18:23 ` Greg KH
2024-10-17 18:24 ` Greg KH
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox