From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-lf1-f41.google.com (mail-lf1-f41.google.com [209.85.167.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4F4A340911F for ; Wed, 1 Jul 2026 23:17:14 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.167.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782947838; cv=none; b=sdtXrZpiLsG8u/Ln22lSoCxH+9kW0YqpFwrslrZfvwWspZreYwFdYT+c+z/GGlhNFYDVqkmK5D4sAjnadEDIFhf9RgBCfIt2LyPvwOMejiXpzfhHagi9Xyhxk7eZV3qjIDbp1KxUOdlN6z/Ozw1CVjERKeWlOkVz5pvGgG7Yglw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1782947838; c=relaxed/simple; bh=NwvngB55nrQuY2zsw+u/UlQ+ziOq9i4AgvNGIC5B8qg=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=MSTM5Nx6CkYNHrd0u08dZ0SnRjQiXe5IiLV6MibNA5aOumu6SFCfHKUUR/zLKjMpQ99ZUQD74b7iosvKtg5i8u2u1gj1HLH24B7eW1VbvvezdQN/XCiTC0gLabxQUsV4KCoy0m7oiLr/CRhpHkwdA7T/7SPF0jC7xVwEM07E3pI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=CSIpZY85; arc=none smtp.client-ip=209.85.167.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="CSIpZY85" Received: by mail-lf1-f41.google.com with SMTP id 2adb3069b0e04-5aea0fff535so1280885e87.3 for ; Wed, 01 Jul 2026 16:17:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1782947832; x=1783552632; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=HjOEsE0qEDjFyTwl3K+CtParcmWNsl4rWJyxgaM5lGk=; b=CSIpZY85TZwwhMrmUWTKmXQvvXKXXOigC5Y+Y1i+1fTGxltzauMeK4jdgB6AK7ULox bB2EnJSIU0+H88MQ2m3GgqimnNrTBiQUolZKiYTuQUJLUvhsGEG4WMWVKFanimUfpDC1 X1wuGCSE4N/ffZJhWwn0roSjXEJ+Yb8GMlsmZMKCvjUolGEY3/UzFa9WetnEdt47Bt08 ZeJietjzyb/MH9auiw5RHlZ/7hV1vd/4Q8AqevCiJpmGjf71JccOpivyhu6cq0xDpcc1 qjV5D/lyvVQ232y+qXcVRatyslA1FXz/UDTHUJ5fR5IUNeDdA+3FPxaHqAw97oHKM9ez XJxA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1782947832; x=1783552632; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=HjOEsE0qEDjFyTwl3K+CtParcmWNsl4rWJyxgaM5lGk=; b=f29IrnFabK7d1LY/rp7umz3pDp/HychSlELTbtZOa1KPJKVrai9HBO2uhrV7NtyObF I7VBqoaVwEh4I3PlnwT/03P/Gdkfy1fS0e5lDUflQM9WMbWuEgbfNCevrbVLkWf9jIaS VQ0WkFQrnS3cC5+8Hu0xT0Vijh9owG69fkNuLBqqOoRSecbTjKRlG3WN+NGKBFMnAFcA KiWaAlAolNyzW6nk+AbdgNxPuzrkXoCyXOrcqyAE+6jhLKyeCF1C+2fkCiemab18h84c xCAlZ59Nk/ndHFqFq2MuIfUz7Ex1NUsoPn6W6+KoXHnLF2NXNb0YylkdTYHEgDxVaWJQ kEWw== X-Forwarded-Encrypted: i=1; AHgh+RpgV4d2Q7zkl4d7OgsVeomZ//cDwhdzfY5QdFWAFropmtzM5qhVB73Qq9DQWxa8KXcrMYs5WN8R/JeZ3K4=@vger.kernel.org X-Gm-Message-State: AOJu0YxZx1H2Rk0eEF64Q1zcU9nuKrh4wogNLdk2S2PIpNDHBedRlbeB /Raf/bgLUsDD8u1tD0n0X3gy8UnJkk8/7yzPuatIY+pNvbGLmvB5wQxv X-Gm-Gg: AfdE7cnlQhgg223CUtfnhDeCUDrqCwg8MP2fkYvOcXGWJxHfv7PG68L9jfDQVVvlrGW DUXzz+YODkOE2QG18csm+rDwDbnTmyP24MAFzx6hEcLgb2sz6e2Fdng+jFTDfNeKc9JuksKjHe+ lFzRKbSF0Ur3X6MRTeCD7a3Tg6g59jOtgBF2G2CsLDuH+ALiQ+q8r47VAxGyxt/M2OqvtQoH6g5 SkC7pBwDtM+dOBr3MfsSuVu3v8R9Y+fGT863xAj9Ks8nP4Wju+AGuHO/5Nm7z+0TTR8ROYxyjBZ dG2S2J8ws8FhaZxANLl/qGfsSCSfwGIcMtoIBnlmov41Thbzv+wO4LgQkRizqaYJMch2rIjgmoW 7PwDBepJF8jcpQ+maoRf7tiGDYkj7g28W6WhUDLenl49iBnlyFLXWTD04bvCEPGhBwiGV/1SYpL W+hkKJJWIWmDghIDLDJKc4ctR4TBJ8c5n7JmNe4GtDjA== X-Received: by 2002:a05:6512:8387:b0:5ae:9c19:165c with SMTP id 2adb3069b0e04-5aec7fe9d35mr502903e87.7.1782947832122; Wed, 01 Jul 2026 16:17:12 -0700 (PDT) Received: from localhost.localdomain ([2a01:4f9:2a:1c13::2]) by smtp.gmail.com with ESMTPSA id 2adb3069b0e04-5aec8991974sm308950e87.4.2026.07.01.16.17.08 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 01 Jul 2026 16:17:10 -0700 (PDT) From: Melbin K Mathew To: deller@gmx.de Cc: linux-fbdev@vger.kernel.org, dri-devel@lists.freedesktop.org, linux-kernel@vger.kernel.org, Melbin K Mathew , stable@vger.kernel.org Subject: [PATCH v2 1/2] fbdev: bound mode sysfs output to the sysfs buffer Date: Thu, 2 Jul 2026 01:17:05 +0200 Message-Id: <20260701231706.234715-2-mlbnkm1@gmail.com> X-Mailer: git-send-email 2.39.5 In-Reply-To: <20260701221757.231490-1-mlbnkm1@gmail.com> References: <20260701221757.231490-1-mlbnkm1@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit mode_string() uses snprintf() which can return a value larger than the remaining buffer space. show_modes() accumulates the return value into i without checking whether i has reached PAGE_SIZE, causing the offset to advance past the sysfs buffer if the modelist is long enough. Add a size parameter to mode_string() and use scnprintf() to return only the bytes actually written. Add an early return when offset already exceeds the buffer. In show_modes(), stop accumulating once the buffer is full. Cc: stable@vger.kernel.org Signed-off-by: Melbin K Mathew --- drivers/video/fbdev/core/fbsysfs.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/drivers/video/fbdev/core/fbsysfs.c b/drivers/video/fbdev/core/fbsysfs.c index ea196603c7..af21dc5052 100644 --- a/drivers/video/fbdev/core/fbsysfs.c +++ b/drivers/video/fbdev/core/fbsysfs.c @@ -27,12 +27,15 @@ static int activate(struct fb_info *fb_info, struct fb_var_screeninfo *var) return 0; } -static int mode_string(char *buf, unsigned int offset, +static int mode_string(char *buf, size_t size, unsigned int offset, const struct fb_videomode *mode) { char m = 'U'; char v = 'p'; + if (offset >= size) + return 0; + if (mode->flag & FB_MODE_IS_DETAILED) m = 'D'; if (mode->flag & FB_MODE_IS_VESA) @@ -45,7 +48,7 @@ static int mode_string(char *buf, unsigned int offset, if (mode->vmode & FB_VMODE_DOUBLE) v = 'd'; - return snprintf(&buf[offset], PAGE_SIZE - offset, "%c:%dx%d%c-%d\n", + return scnprintf(&buf[offset], size - offset, "%c:%dx%d%c-%d\n", m, mode->xres, mode->yres, v, mode->refresh); } @@ -64,7 +67,7 @@ static ssize_t store_mode(struct device *device, struct device_attribute *attr, list_for_each_entry(modelist, &fb_info->modelist, list) { mode = &modelist->mode; - i = mode_string(mstr, 0, mode); + i = mode_string(mstr, sizeof(mstr), 0, mode); if (strncmp(mstr, buf, max(count, i)) == 0) { var = fb_info->var; @@ -86,7 +89,7 @@ static ssize_t show_mode(struct device *device, struct device_attribute *attr, if (!fb_info->mode) return 0; - return mode_string(buf, 0, fb_info->mode); + return mode_string(buf, PAGE_SIZE, 0, fb_info->mode); } static ssize_t store_modes(struct device *device, @@ -136,7 +139,9 @@ static ssize_t show_modes(struct device *device, struct device_attribute *attr, i = 0; list_for_each_entry(modelist, &fb_info->modelist, list) { mode = &modelist->mode; - i += mode_string(buf, i, mode); + i += mode_string(buf, PAGE_SIZE, i, mode); + if (i >= PAGE_SIZE - 1) + break; } return i; } -- 2.39.5