Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

s390/cio: Use scnprintf() instead of sprintf()

Use scnprintf() instead of sprintf() for those cases where the destination
is an array and the size of the array is known at compile time.

This prevents theoretical buffer overflows, but also avoids that people
again and again spend time to figure out if the code is actually safe.

Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>

+13 -12
+3 -3
drivers/s390/cio/ccwgroup.c
··· 41 41 char str[16]; 42 42 43 43 for (i = 0; i < gdev->count; i++) { 44 - sprintf(str, "cdev%d", i); 44 + scnprintf(str, sizeof(str), "cdev%d", i); 45 45 sysfs_remove_link(&gdev->dev.kobj, str); 46 46 sysfs_remove_link(&gdev->cdev[i]->dev.kobj, "group_device"); 47 47 } ··· 249 249 } 250 250 } 251 251 for (i = 0; i < gdev->count; i++) { 252 - sprintf(str, "cdev%d", i); 252 + scnprintf(str, sizeof(str), "cdev%d", i); 253 253 rc = sysfs_create_link(&gdev->dev.kobj, 254 254 &gdev->cdev[i]->dev.kobj, str); 255 255 if (rc) { 256 256 while (i--) { 257 - sprintf(str, "cdev%d", i); 257 + scnprintf(str, sizeof(str), "cdev%d", i); 258 258 sysfs_remove_link(&gdev->dev.kobj, str); 259 259 } 260 260 for (i = 0; i < gdev->count; i++)
+3 -2
drivers/s390/cio/chp.c
··· 111 111 char dbf_text[15]; 112 112 int status; 113 113 114 - sprintf(dbf_text, on?"varyon%x.%02x":"varyoff%x.%02x", chpid.cssid, 115 - chpid.id); 114 + scnprintf(dbf_text, sizeof(dbf_text), 115 + on ? "varyon%x.%02x" : "varyoff%x.%02x", 116 + chpid.cssid, chpid.id); 116 117 CIO_TRACE_EVENT(2, dbf_text); 117 118 118 119 status = chp_get_status(chpid);
+5 -5
drivers/s390/cio/chsc.c
··· 253 253 struct chp_link link; 254 254 char dbf_txt[15]; 255 255 256 - sprintf(dbf_txt, "chpr%x.%02x", chpid.cssid, chpid.id); 256 + scnprintf(dbf_txt, sizeof(dbf_txt), "chpr%x.%02x", chpid.cssid, chpid.id); 257 257 CIO_TRACE_EVENT(2, dbf_txt); 258 258 259 259 if (chp_get_status(chpid) <= 0) ··· 284 284 { 285 285 char dbf_txt[15]; 286 286 287 - sprintf(dbf_txt, "accpr%x.%02x", link->chpid.cssid, 288 - link->chpid.id); 287 + scnprintf(dbf_txt, sizeof(dbf_txt), "accpr%x.%02x", link->chpid.cssid, 288 + link->chpid.id); 289 289 CIO_TRACE_EVENT( 2, dbf_txt); 290 290 if (link->fla != 0) { 291 - sprintf(dbf_txt, "fla%x", link->fla); 291 + scnprintf(dbf_txt, sizeof(dbf_txt), "fla%x", link->fla); 292 292 CIO_TRACE_EVENT( 2, dbf_txt); 293 293 } 294 294 /* Wait until previous actions have settled. */ ··· 757 757 struct chp_link link; 758 758 char dbf_txt[15]; 759 759 760 - sprintf(dbf_txt, "cadd%x.%02x", chpid.cssid, chpid.id); 760 + scnprintf(dbf_txt, sizeof(dbf_txt), "cadd%x.%02x", chpid.cssid, chpid.id); 761 761 CIO_TRACE_EVENT(2, dbf_txt); 762 762 763 763 if (chp_get_status(chpid) != 0) {
+1 -1
drivers/s390/cio/cio.c
··· 113 113 if (cio_update_schib(sch)) 114 114 return -ENODEV; 115 115 116 - sprintf(dbf_text, "no%s", dev_name(&sch->dev)); 116 + scnprintf(dbf_text, sizeof(dbf_text), "no%s", dev_name(&sch->dev)); 117 117 CIO_TRACE_EVENT(0, dbf_text); 118 118 CIO_HEX_EVENT(0, &sch->schib, sizeof (struct schib)); 119 119
+1 -1
drivers/s390/cio/device_status.c
··· 42 42 cdev->private->dev_id.devno, sch->schid.ssid, 43 43 sch->schid.sch_no, 44 44 scsw_dstat(&irb->scsw), scsw_cstat(&irb->scsw)); 45 - sprintf(dbf_text, "chk%x", sch->schid.sch_no); 45 + scnprintf(dbf_text, sizeof(dbf_text), "chk%x", sch->schid.sch_no); 46 46 CIO_TRACE_EVENT(0, dbf_text); 47 47 CIO_HEX_EVENT(0, irb, sizeof(struct irb)); 48 48 }