hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

EDAC/armada_xp: Use scnprintf() for avoiding potential buffer overflow 

Since snprintf() returns the would-be-output size instead of the actual
output size, the succeeding calls may go beyond the given buffer limit.
Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Borislav Petkov <bp@suse.de>
Reviewed-by: Jan Luebbe <jlu@pengutronix.de>
Link: https://lkml.kernel.org/r/20200311071728.4541-1-tiwai@suse.de
This commit is contained in:
Takashi Iwai 2020-03-11 08:17:28 +01:00 committed by Borislav Petkov
parent 52cff04a81
commit 215a423cc0
1 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

26
drivers/edac/armada_xp_edac.c
View File

@ -429,26 +429,26 @@ static void aurora_l2_check(struct edac_device_ctl_info *dci)
src = (attr_cap & AURORA_ERR_ATTR_SRC_MSK) >> AURORA_ERR_ATTR_SRC_OFF; src = (attr_cap & AURORA_ERR_ATTR_SRC_MSK) >> AURORA_ERR_ATTR_SRC_OFF;
if (src <= 3) if (src <= 3)
len += snprintf(msg+len, size-len, "src=CPU%d ", src); len += scnprintf(msg+len, size-len, "src=CPU%d ", src);
else else
len += snprintf(msg+len, size-len, "src=IO "); len += scnprintf(msg+len, size-len, "src=IO ");
txn = (attr_cap & AURORA_ERR_ATTR_TXN_MSK) >> AURORA_ERR_ATTR_TXN_OFF; txn = (attr_cap & AURORA_ERR_ATTR_TXN_MSK) >> AURORA_ERR_ATTR_TXN_OFF;
switch (txn) { switch (txn) {
case 0: case 0:
len += snprintf(msg+len, size-len, "txn=Data-Read "); len += scnprintf(msg+len, size-len, "txn=Data-Read ");
break; break;
case 1: case 1:
len += snprintf(msg+len, size-len, "txn=Isn-Read "); len += scnprintf(msg+len, size-len, "txn=Isn-Read ");
break; break;
case 2: case 2:
len += snprintf(msg+len, size-len, "txn=Clean-Flush "); len += scnprintf(msg+len, size-len, "txn=Clean-Flush ");
break; break;
case 3: case 3:
len += snprintf(msg+len, size-len, "txn=Eviction "); len += scnprintf(msg+len, size-len, "txn=Eviction ");
break; break;
case 4: case 4:
len += snprintf(msg+len, size-len, len += scnprintf(msg+len, size-len,
"txn=Read-Modify-Write "); "txn=Read-Modify-Write ");
break; break;
} }
@ -456,19 +456,19 @@ static void aurora_l2_check(struct edac_device_ctl_info *dci)
err = (attr_cap & AURORA_ERR_ATTR_ERR_MSK) >> AURORA_ERR_ATTR_ERR_OFF; err = (attr_cap & AURORA_ERR_ATTR_ERR_MSK) >> AURORA_ERR_ATTR_ERR_OFF;
switch (err) { switch (err) {
case 0: case 0:
len += snprintf(msg+len, size-len, "err=CorrECC "); len += scnprintf(msg+len, size-len, "err=CorrECC ");
break; break;
case 1: case 1:
len += snprintf(msg+len, size-len, "err=UnCorrECC "); len += scnprintf(msg+len, size-len, "err=UnCorrECC ");
break; break;
case 2: case 2:
len += snprintf(msg+len, size-len, "err=TagParity "); len += scnprintf(msg+len, size-len, "err=TagParity ");
break; break;
} }
len += snprintf(msg+len, size-len, "addr=0x%x ", addr_cap & AURORA_ERR_ADDR_CAP_ADDR_MASK); len += scnprintf(msg+len, size-len, "addr=0x%x ", addr_cap & AURORA_ERR_ADDR_CAP_ADDR_MASK);
len += snprintf(msg+len, size-len, "index=0x%x ", (way_cap & AURORA_ERR_WAY_IDX_MSK) >> AURORA_ERR_WAY_IDX_OFF); len += scnprintf(msg+len, size-len, "index=0x%x ", (way_cap & AURORA_ERR_WAY_IDX_MSK) >> AURORA_ERR_WAY_IDX_OFF);
len += snprintf(msg+len, size-len, "way=0x%x", (way_cap & AURORA_ERR_WAY_CAP_WAY_MASK) >> AURORA_ERR_WAY_CAP_WAY_OFFSET); len += scnprintf(msg+len, size-len, "way=0x%x", (way_cap & AURORA_ERR_WAY_CAP_WAY_MASK) >> AURORA_ERR_WAY_CAP_WAY_OFFSET);
/* clear error capture registers */ /* clear error capture registers */
writel(AURORA_ERR_ATTR_CAP_VALID, drvdata->base + AURORA_ERR_ATTR_CAP_REG); writel(AURORA_ERR_ATTR_CAP_VALID, drvdata->base + AURORA_ERR_ATTR_CAP_REG);