Commit 3c0897c1 authored by Takashi Iwai's avatar Takashi Iwai Committed by Rafael J. Wysocki
Browse files

cpufreq: Use scnprintf() for avoiding potential buffer overflow 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Acked-by: default avatarViresh Kumar <viresh.kumar@linaro.org>
Signed-off-by: default avatarRafael J. Wysocki <rafael.j.wysocki@intel.com>
parent c1f59a37

drivers/cpufreq/cpufreq_stats.c

+7 −7
Original line number Diff line number Diff line
@@ -90,35 +90,35 @@ static ssize_t show_trans_table(struct cpufreq_policy *policy, char *buf) 
	if (policy->fast_switch_enabled)

		return 0;



	len += snprintf(buf + len, PAGE_SIZE - len, "   From  :    To\n");

	len += snprintf(buf + len, PAGE_SIZE - len, "         : ");

	len += scnprintf(buf + len, PAGE_SIZE - len, "   From  :    To\n");

	len += scnprintf(buf + len, PAGE_SIZE - len, "         : ");

	for (i = 0; i < stats->state_num; i++) {

		if (len >= PAGE_SIZE)

			break;

		len += snprintf(buf + len, PAGE_SIZE - len, "%9u ",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%9u ",

				stats->freq_table[i]);

	}

	if (len >= PAGE_SIZE)

		return PAGE_SIZE;



	len += snprintf(buf + len, PAGE_SIZE - len, "\n");

	len += scnprintf(buf + len, PAGE_SIZE - len, "\n");



	for (i = 0; i < stats->state_num; i++) {

		if (len >= PAGE_SIZE)

			break;



		len += snprintf(buf + len, PAGE_SIZE - len, "%9u: ",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%9u: ",

				stats->freq_table[i]);



		for (j = 0; j < stats->state_num; j++) {

			if (len >= PAGE_SIZE)

				break;

			len += snprintf(buf + len, PAGE_SIZE - len, "%9u ",

			len += scnprintf(buf + len, PAGE_SIZE - len, "%9u ",

					stats->trans_table[i*stats->max_state+j]);

		}

		if (len >= PAGE_SIZE)

			break;

		len += snprintf(buf + len, PAGE_SIZE - len, "\n");

		len += scnprintf(buf + len, PAGE_SIZE - len, "\n");

	}



	if (len >= PAGE_SIZE) {

CRA Git | Maintained and supported by SUSTech CRA and CCSE