Commit 0de005d0 authored by Takashi Iwai's avatar Takashi Iwai Committed by Greg Kroah-Hartman
Browse files

USB: mon: Use scnprintf() for avoiding potential buffer overflow 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200311093003.24604-1-tiwai@suse.de


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 8e567ed9

drivers/usb/mon/mon_text.c

+18 −18
Original line number Diff line number Diff line
@@ -414,7 +414,7 @@ static ssize_t mon_text_read_t(struct file *file, char __user *buf, 


		mon_text_read_head_t(rp, &ptr, ep);

		mon_text_read_statset(rp, &ptr, ep);

		ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,

		ptr.cnt += scnprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,

		    " %d", ep->length);

		mon_text_read_data(rp, &ptr, ep);
@@ -462,7 +462,7 @@ static ssize_t mon_text_read_u(struct file *file, char __user *buf, 
		} else {

			mon_text_read_statset(rp, &ptr, ep);

		}

		ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,

		ptr.cnt += scnprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,

		    " %d", ep->length);

		mon_text_read_data(rp, &ptr, ep);
@@ -520,7 +520,7 @@ static void mon_text_read_head_t(struct mon_reader_text *rp, 
	case USB_ENDPOINT_XFER_CONTROL:	utype = 'C'; break;

	default: /* PIPE_BULK */  utype = 'B';

	}

	p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

	p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

	    "%lx %u %c %c%c:%03u:%02u",

	    ep->id, ep->tstamp, ep->type,

	    utype, udir, ep->devnum, ep->epnum);
@@ -538,7 +538,7 @@ static void mon_text_read_head_u(struct mon_reader_text *rp, 
	case USB_ENDPOINT_XFER_CONTROL:	utype = 'C'; break;

	default: /* PIPE_BULK */  utype = 'B';

	}

	p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

	p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

	    "%lx %u %c %c%c:%d:%03u:%u",

	    ep->id, ep->tstamp, ep->type,

	    utype, udir, ep->busnum, ep->devnum, ep->epnum);
@@ -549,7 +549,7 @@ static void mon_text_read_statset(struct mon_reader_text *rp, 
{



	if (ep->setup_flag == 0) {   /* Setup packet is present and captured */

		p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		    " s %02x %02x %04x %04x %04x",

		    ep->setup[0],

		    ep->setup[1],
@@ -557,10 +557,10 @@ static void mon_text_read_statset(struct mon_reader_text *rp, 
		    (ep->setup[5] << 8) | ep->setup[4],

		    (ep->setup[7] << 8) | ep->setup[6]);

	} else if (ep->setup_flag != '-') { /* Unable to capture setup packet */

		p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		    " %c __ __ ____ ____ ____", ep->setup_flag);

	} else {                     /* No setup for this kind of URB */

		p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		    " %d", ep->status);

	}

}
@@ -568,7 +568,7 @@ static void mon_text_read_statset(struct mon_reader_text *rp, 
static void mon_text_read_intstat(struct mon_reader_text *rp,

	struct mon_text_ptr *p, const struct mon_event_text *ep)

{

	p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

	p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

	    " %d:%d", ep->status, ep->interval);

}
@@ -576,10 +576,10 @@ static void mon_text_read_isostat(struct mon_reader_text *rp, 
	struct mon_text_ptr *p, const struct mon_event_text *ep)

{

	if (ep->type == 'S') {

		p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		    " %d:%d:%d", ep->status, ep->interval, ep->start_frame);

	} else {

		p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		    " %d:%d:%d:%d",

		    ep->status, ep->interval, ep->start_frame, ep->error_count);

	}
@@ -592,7 +592,7 @@ static void mon_text_read_isodesc(struct mon_reader_text *rp, 
	int i;

	const struct mon_iso_desc *dp;



	p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

	p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

	    " %d", ep->numdesc);

	ndesc = ep->numdesc;

	if (ndesc > ISODESC_MAX)
@@ -601,7 +601,7 @@ static void mon_text_read_isodesc(struct mon_reader_text *rp, 
		ndesc = 0;

	dp = ep->isodesc;

	for (i = 0; i < ndesc; i++) {

		p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

		    " %d:%u:%u", dp->status, dp->offset, dp->length);

		dp++;

	}
@@ -614,28 +614,28 @@ static void mon_text_read_data(struct mon_reader_text *rp, 


	if ((data_len = ep->length) > 0) {

		if (ep->data_flag == 0) {

			p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

			p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

			    " =");

			if (data_len >= DATA_MAX)

				data_len = DATA_MAX;

			for (i = 0; i < data_len; i++) {

				if (i % 4 == 0) {

					p->cnt += snprintf(p->pbuf + p->cnt,

					p->cnt += scnprintf(p->pbuf + p->cnt,

					    p->limit - p->cnt,

					    " ");

				}

				p->cnt += snprintf(p->pbuf + p->cnt,

				p->cnt += scnprintf(p->pbuf + p->cnt,

				    p->limit - p->cnt,

				    "%02x", ep->data[i]);

			}

			p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

			p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

			    "\n");

		} else {

			p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,

			p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,

			    " %c\n", ep->data_flag);

		}

	} else {

		p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, "\n");

		p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt, "\n");

	}

}

CRA Git | Maintained and supported by SUSTech CRA and CCSE