net: nfp: Use scnprintf() for avoiding potential buffer overflow (413ae546) · Commits · 戴 / test

Since snprintf() returns the would-be-output size instead of the actual output size, the succeeding calls may go beyond the given buffer limit. Fix it by replacing with scnprintf(). Reviewed-by:

Simon Horman <simon.horman@netronome.com> Cc: "David S . Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: oss-drivers@netronome.com To: netdev@vger.kernel.org Signed-off-by:

Takashi Iwai <tiwai@suse.de> Signed-off-by:

David S. Miller <davem@davemloft.net>

drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c

+4 −4

Original line number	Diff line number	Diff line
		@@ -616,7 +616,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
		if (bar->iomem) {
		int pf;

		msg += snprintf(msg, end - msg, "0.0: General/MSI-X SRAM, ");
		msg += scnprintf(msg, end - msg, "0.0: General/MSI-X SRAM, ");
		atomic_inc(&bar->refcnt);
		bars_free--;

		@@ -661,7 +661,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)

		/* Configure, and lock, BAR0.1 for PCIe XPB (MSI-X PBA) */
		bar = &nfp->bar[1];
		msg += snprintf(msg, end - msg, "0.1: PCIe XPB/MSI-X PBA, ");
		msg += scnprintf(msg, end - msg, "0.1: PCIe XPB/MSI-X PBA, ");
		atomic_inc(&bar->refcnt);
		bars_free--;

		@@ -680,7 +680,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface)
		bar->iomem = ioremap(nfp_bar_resource_start(bar),
		nfp_bar_resource_len(bar));
		if (bar->iomem) {
		msg += snprintf(msg, end - msg,
		msg += scnprintf(msg, end - msg,
		"0.%d: Explicit%d, ", 4 + i, i);
		atomic_inc(&bar->refcnt);
		bars_free--;

Admin message