Commit c6d5789b authored by Takashi Iwai's avatar Takashi Iwai Committed by Jaegeuk Kim
Browse files

f2fs: Use scnprintf() for avoiding potential buffer overflow 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Reviewed-by: default avatarChao Yu <yuchao0@huawei.com>
Signed-off-by: default avatarJaegeuk Kim <jaegeuk@kernel.org>
parent 2536ac68

fs/f2fs/sysfs.c

+19 −19
Original line number Diff line number Diff line
@@ -109,47 +109,47 @@ static ssize_t features_show(struct f2fs_attr *a, 
		return sprintf(buf, "0\n");



	if (f2fs_sb_has_encrypt(sbi))

		len += snprintf(buf, PAGE_SIZE - len, "%s",

		len += scnprintf(buf, PAGE_SIZE - len, "%s",

						"encryption");

	if (f2fs_sb_has_blkzoned(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "blkzoned");

	if (f2fs_sb_has_extra_attr(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "extra_attr");

	if (f2fs_sb_has_project_quota(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "projquota");

	if (f2fs_sb_has_inode_chksum(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "inode_checksum");

	if (f2fs_sb_has_flexible_inline_xattr(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "flexible_inline_xattr");

	if (f2fs_sb_has_quota_ino(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "quota_ino");

	if (f2fs_sb_has_inode_crtime(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "inode_crtime");

	if (f2fs_sb_has_lost_found(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "lost_found");

	if (f2fs_sb_has_verity(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "verity");

	if (f2fs_sb_has_sb_chksum(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "sb_checksum");

	if (f2fs_sb_has_casefold(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "casefold");

	if (f2fs_sb_has_compression(sbi))

		len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

		len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "compression");

	len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",

	len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",

				len ? ", " : "", "pin_file");

	len += snprintf(buf + len, PAGE_SIZE - len, "\n");

	len += scnprintf(buf + len, PAGE_SIZE - len, "\n");

	return len;

}
@@ -233,16 +233,16 @@ static ssize_t f2fs_sbi_show(struct f2fs_attr *a, 
		int hot_count = sbi->raw_super->hot_ext_count;

		int len = 0, i;



		len += snprintf(buf + len, PAGE_SIZE - len,

		len += scnprintf(buf + len, PAGE_SIZE - len,

						"cold file extension:\n");

		for (i = 0; i < cold_count; i++)

			len += snprintf(buf + len, PAGE_SIZE - len, "%s\n",

			len += scnprintf(buf + len, PAGE_SIZE - len, "%s\n",

								extlist[i]);



		len += snprintf(buf + len, PAGE_SIZE - len,

		len += scnprintf(buf + len, PAGE_SIZE - len,

						"hot file extension:\n");

		for (i = cold_count; i < cold_count + hot_count; i++)

			len += snprintf(buf + len, PAGE_SIZE - len, "%s\n",

			len += scnprintf(buf + len, PAGE_SIZE - len, "%s\n",

								extlist[i]);

		return len;

	}

CRA Git | Maintained and supported by SUSTech CRA and CCSE