diff mbox series

[v4,1/3] platform/mellanox: mlxbf-pmc: Fix potential buffer overflows

Message ID bef39ef32319a31b32f999065911f61b0d3b17c3.1693917738.git.shravankr@nvidia.com (mailing list archive)
State Accepted, archived
Headers show
Series Updates to Mellanox PMC driver | expand

Commit Message

Shravan Ramani Sept. 5, 2023, 12:49 p.m. UTC
Replace sprintf with sysfs_emit where possible.
Size check in mlxbf_pmc_event_list_show should account for "\0".

Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver")
Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com>
Reviewed-by: Vadim Pasternak <vadimp@nvidia.com>
Reviewed-by: David Thompson <davthompson@nvidia.com>
---
 drivers/platform/mellanox/mlxbf-pmc.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

Comments

Hans de Goede Sept. 11, 2023, 11:14 a.m. UTC | #1
Hi,

On 9/5/23 14:49, Shravan Kumar Ramani wrote:
> Replace sprintf with sysfs_emit where possible.
> Size check in mlxbf_pmc_event_list_show should account for "\0".
> 
> Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver")
> Signed-off-by: Shravan Kumar Ramani <shravankr@nvidia.com>
> Reviewed-by: Vadim Pasternak <vadimp@nvidia.com>
> Reviewed-by: David Thompson <davthompson@nvidia.com>

Thank you for your patch, I've applied this patch to my fixes
branch:
https://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86.git/log/?h=fixes

Note it will show up in my fixes branch once I've pushed my
local branch there, which might take a while.

I will include this patch in my next fixes pull-req to Linus
for the current kernel development cycle.

Regards,

Hans

> ---
>  drivers/platform/mellanox/mlxbf-pmc.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c
> index be967d797c28..95afcae7b9fa 100644
> --- a/drivers/platform/mellanox/mlxbf-pmc.c
> +++ b/drivers/platform/mellanox/mlxbf-pmc.c
> @@ -1008,7 +1008,7 @@ static ssize_t mlxbf_pmc_counter_show(struct device *dev,
>  	} else
>  		return -EINVAL;
>  
> -	return sprintf(buf, "0x%llx\n", value);
> +	return sysfs_emit(buf, "0x%llx\n", value);
>  }
>  
>  /* Store function for "counter" sysfs files */
> @@ -1078,13 +1078,13 @@ static ssize_t mlxbf_pmc_event_show(struct device *dev,
>  
>  	err = mlxbf_pmc_read_event(blk_num, cnt_num, is_l3, &evt_num);
>  	if (err)
> -		return sprintf(buf, "No event being monitored\n");
> +		return sysfs_emit(buf, "No event being monitored\n");
>  
>  	evt_name = mlxbf_pmc_get_event_name(pmc->block_name[blk_num], evt_num);
>  	if (!evt_name)
>  		return -EINVAL;
>  
> -	return sprintf(buf, "0x%llx: %s\n", evt_num, evt_name);
> +	return sysfs_emit(buf, "0x%llx: %s\n", evt_num, evt_name);
>  }
>  
>  /* Store function for "event" sysfs files */
> @@ -1139,9 +1139,9 @@ static ssize_t mlxbf_pmc_event_list_show(struct device *dev,
>  		return -EINVAL;
>  
>  	for (i = 0, buf[0] = '\0'; i < size; ++i) {
> -		len += sprintf(e_info, "0x%x: %s\n", events[i].evt_num,
> -			       events[i].evt_name);
> -		if (len > PAGE_SIZE)
> +		len += snprintf(e_info, sizeof(e_info), "0x%x: %s\n",
> +				events[i].evt_num, events[i].evt_name);
> +		if (len >= PAGE_SIZE)
>  			break;
>  		strcat(buf, e_info);
>  		ret = len;
> @@ -1168,7 +1168,7 @@ static ssize_t mlxbf_pmc_enable_show(struct device *dev,
>  
>  	value = FIELD_GET(MLXBF_PMC_L3C_PERF_CNT_CFG_EN, perfcnt_cfg);
>  
> -	return sprintf(buf, "%d\n", value);
> +	return sysfs_emit(buf, "%d\n", value);
>  }
>  
>  /* Store function for "enable" sysfs files - only for l3cache */
diff mbox series

Patch

diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c
index be967d797c28..95afcae7b9fa 100644
--- a/drivers/platform/mellanox/mlxbf-pmc.c
+++ b/drivers/platform/mellanox/mlxbf-pmc.c
@@ -1008,7 +1008,7 @@  static ssize_t mlxbf_pmc_counter_show(struct device *dev,
 	} else
 		return -EINVAL;
 
-	return sprintf(buf, "0x%llx\n", value);
+	return sysfs_emit(buf, "0x%llx\n", value);
 }
 
 /* Store function for "counter" sysfs files */
@@ -1078,13 +1078,13 @@  static ssize_t mlxbf_pmc_event_show(struct device *dev,
 
 	err = mlxbf_pmc_read_event(blk_num, cnt_num, is_l3, &evt_num);
 	if (err)
-		return sprintf(buf, "No event being monitored\n");
+		return sysfs_emit(buf, "No event being monitored\n");
 
 	evt_name = mlxbf_pmc_get_event_name(pmc->block_name[blk_num], evt_num);
 	if (!evt_name)
 		return -EINVAL;
 
-	return sprintf(buf, "0x%llx: %s\n", evt_num, evt_name);
+	return sysfs_emit(buf, "0x%llx: %s\n", evt_num, evt_name);
 }
 
 /* Store function for "event" sysfs files */
@@ -1139,9 +1139,9 @@  static ssize_t mlxbf_pmc_event_list_show(struct device *dev,
 		return -EINVAL;
 
 	for (i = 0, buf[0] = '\0'; i < size; ++i) {
-		len += sprintf(e_info, "0x%x: %s\n", events[i].evt_num,
-			       events[i].evt_name);
-		if (len > PAGE_SIZE)
+		len += snprintf(e_info, sizeof(e_info), "0x%x: %s\n",
+				events[i].evt_num, events[i].evt_name);
+		if (len >= PAGE_SIZE)
 			break;
 		strcat(buf, e_info);
 		ret = len;
@@ -1168,7 +1168,7 @@  static ssize_t mlxbf_pmc_enable_show(struct device *dev,
 
 	value = FIELD_GET(MLXBF_PMC_L3C_PERF_CNT_CFG_EN, perfcnt_cfg);
 
-	return sprintf(buf, "%d\n", value);
+	return sysfs_emit(buf, "%d\n", value);
 }
 
 /* Store function for "enable" sysfs files - only for l3cache */