hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

USB: mon: Use scnprintf() for avoiding potential buffer overflow 

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200311093003.24604-1-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Takashi Iwai 2020-03-11 10:30:03 +01:00 committed by Greg Kroah-Hartman
parent 8e567ed9e2
commit 0de005d0e4
1 changed files with 18 additions and 18 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
drivers/usb/mon/mon_text.c
View File

@ -414,7 +414,7 @@ static ssize_t mon_text_read_t(struct file *file, char __user *buf,
mon_text_read_head_t(rp, &ptr, ep); mon_text_read_head_t(rp, &ptr, ep);
mon_text_read_statset(rp, &ptr, ep); mon_text_read_statset(rp, &ptr, ep);
ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ptr.cnt += scnprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
" %d", ep->length); " %d", ep->length);
mon_text_read_data(rp, &ptr, ep); mon_text_read_data(rp, &ptr, ep);
@ -462,7 +462,7 @@ static ssize_t mon_text_read_u(struct file *file, char __user *buf,
} else { } else {
mon_text_read_statset(rp, &ptr, ep); mon_text_read_statset(rp, &ptr, ep);
} }
ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt, ptr.cnt += scnprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
" %d", ep->length); " %d", ep->length);
mon_text_read_data(rp, &ptr, ep); mon_text_read_data(rp, &ptr, ep);
@ -520,7 +520,7 @@ static void mon_text_read_head_t(struct mon_reader_text *rp,
case USB_ENDPOINT_XFER_CONTROL: utype = 'C'; break; case USB_ENDPOINT_XFER_CONTROL: utype = 'C'; break;
default: /* PIPE_BULK */ utype = 'B'; default: /* PIPE_BULK */ utype = 'B';
} }
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
"%lx %u %c %c%c:%03u:%02u", "%lx %u %c %c%c:%03u:%02u",
ep->id, ep->tstamp, ep->type, ep->id, ep->tstamp, ep->type,
utype, udir, ep->devnum, ep->epnum); utype, udir, ep->devnum, ep->epnum);
@ -538,7 +538,7 @@ static void mon_text_read_head_u(struct mon_reader_text *rp,
case USB_ENDPOINT_XFER_CONTROL: utype = 'C'; break; case USB_ENDPOINT_XFER_CONTROL: utype = 'C'; break;
default: /* PIPE_BULK */ utype = 'B'; default: /* PIPE_BULK */ utype = 'B';
} }
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
"%lx %u %c %c%c:%d:%03u:%u", "%lx %u %c %c%c:%d:%03u:%u",
ep->id, ep->tstamp, ep->type, ep->id, ep->tstamp, ep->type,
utype, udir, ep->busnum, ep->devnum, ep->epnum); utype, udir, ep->busnum, ep->devnum, ep->epnum);
@ -549,7 +549,7 @@ static void mon_text_read_statset(struct mon_reader_text *rp,
{ {
if (ep->setup_flag == 0) { /* Setup packet is present and captured */ if (ep->setup_flag == 0) { /* Setup packet is present and captured */
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" s %02x %02x %04x %04x %04x", " s %02x %02x %04x %04x %04x",
ep->setup[0], ep->setup[0],
ep->setup[1], ep->setup[1],
@ -557,10 +557,10 @@ static void mon_text_read_statset(struct mon_reader_text *rp,
(ep->setup[5] << 8) | ep->setup[4], (ep->setup[5] << 8) | ep->setup[4],
(ep->setup[7] << 8) | ep->setup[6]); (ep->setup[7] << 8) | ep->setup[6]);
} else if (ep->setup_flag != '-') { /* Unable to capture setup packet */ } else if (ep->setup_flag != '-') { /* Unable to capture setup packet */
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" %c __ __ ____ ____ ____", ep->setup_flag); " %c __ __ ____ ____ ____", ep->setup_flag);
} else { /* No setup for this kind of URB */ } else { /* No setup for this kind of URB */
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" %d", ep->status); " %d", ep->status);
} }
} }
@ -568,7 +568,7 @@ static void mon_text_read_statset(struct mon_reader_text *rp,
static void mon_text_read_intstat(struct mon_reader_text *rp, static void mon_text_read_intstat(struct mon_reader_text *rp,
struct mon_text_ptr *p, const struct mon_event_text *ep) struct mon_text_ptr *p, const struct mon_event_text *ep)
{ {
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" %d:%d", ep->status, ep->interval); " %d:%d", ep->status, ep->interval);
} }
@ -576,10 +576,10 @@ static void mon_text_read_isostat(struct mon_reader_text *rp,
struct mon_text_ptr *p, const struct mon_event_text *ep) struct mon_text_ptr *p, const struct mon_event_text *ep)
{ {
if (ep->type == 'S') { if (ep->type == 'S') {
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" %d:%d:%d", ep->status, ep->interval, ep->start_frame); " %d:%d:%d", ep->status, ep->interval, ep->start_frame);
} else { } else {
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" %d:%d:%d:%d", " %d:%d:%d:%d",
ep->status, ep->interval, ep->start_frame, ep->error_count); ep->status, ep->interval, ep->start_frame, ep->error_count);
} }
@ -592,7 +592,7 @@ static void mon_text_read_isodesc(struct mon_reader_text *rp,
int i; int i;
const struct mon_iso_desc *dp; const struct mon_iso_desc *dp;
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" %d", ep->numdesc); " %d", ep->numdesc);
ndesc = ep->numdesc; ndesc = ep->numdesc;
if (ndesc > ISODESC_MAX) if (ndesc > ISODESC_MAX)
@ -601,7 +601,7 @@ static void mon_text_read_isodesc(struct mon_reader_text *rp,
ndesc = 0; ndesc = 0;
dp = ep->isodesc; dp = ep->isodesc;
for (i = 0; i < ndesc; i++) { for (i = 0; i < ndesc; i++) {
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" %d:%u:%u", dp->status, dp->offset, dp->length); " %d:%u:%u", dp->status, dp->offset, dp->length);
dp++; dp++;
} }
@ -614,28 +614,28 @@ static void mon_text_read_data(struct mon_reader_text *rp,
if ((data_len = ep->length) > 0) { if ((data_len = ep->length) > 0) {
if (ep->data_flag == 0) { if (ep->data_flag == 0) {
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" ="); " =");
if (data_len >= DATA_MAX) if (data_len >= DATA_MAX)
data_len = DATA_MAX; data_len = DATA_MAX;
for (i = 0; i < data_len; i++) { for (i = 0; i < data_len; i++) {
if (i % 4 == 0) { if (i % 4 == 0) {
p->cnt += snprintf(p->pbuf + p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt,
p->limit - p->cnt, p->limit - p->cnt,
" "); " ");
} }
p->cnt += snprintf(p->pbuf + p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt,
p->limit - p->cnt, p->limit - p->cnt,
"%02x", ep->data[i]); "%02x", ep->data[i]);
} }
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
"\n"); "\n");
} else { } else {
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
" %c\n", ep->data_flag); " %c\n", ep->data_flag);
} }
} else { } else {
p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, "\n"); p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt, "\n");
} }
} }