tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
fork atom

net: ionic: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit. Fix it by replacing with scnprintf().

Reviewed-by: Simon Horman <simon.horman@netronome.com>
Acked-by: Shannon Nelson <snelson@pensando.io>
Cc: "David S . Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: oss-drivers@netronome.com
Cc: netdev@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

authored by

Takashi Iwai and committed by
David S. Miller 38e0f746 413ae546

+7 -7
+7 -7
drivers/net/ethernet/pensando/ionic/ionic_lif.c
··· 948 948 int i; 949 949 #define REMAIN(__x) (sizeof(buf) - (__x)) 950 950 951 - i = snprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:", 952 - lif->rx_mode, rx_mode); 951 + i = scnprintf(buf, sizeof(buf), "rx_mode 0x%04x -> 0x%04x:", 952 + lif->rx_mode, rx_mode); 953 953 if (rx_mode & IONIC_RX_MODE_F_UNICAST) 954 - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST"); 954 + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_UNICAST"); 955 955 if (rx_mode & IONIC_RX_MODE_F_MULTICAST) 956 - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST"); 956 + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_MULTICAST"); 957 957 if (rx_mode & IONIC_RX_MODE_F_BROADCAST) 958 - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST"); 958 + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_BROADCAST"); 959 959 if (rx_mode & IONIC_RX_MODE_F_PROMISC) 960 - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC"); 960 + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_PROMISC"); 961 961 if (rx_mode & IONIC_RX_MODE_F_ALLMULTI) 962 - i += snprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI"); 962 + i += scnprintf(&buf[i], REMAIN(i), " RX_MODE_F_ALLMULTI"); 963 963 netdev_dbg(lif->netdev, "lif%d %s\n", lif->index, buf); 964 964 965 965 err = ionic_adminq_post_wait(lif, &ctx);