Messages in this thread Patch in this message | | | Subject | Re: [RESEND] edac: replace sprintf() by scnprintf() | From | Joe Perches <> | Date | Sat, 10 Jul 2021 09:58:46 -0700 |
| |
On Sat, 2021-07-10 at 17:35 +0100, Salah Triki wrote: > Replace sprintf() by scnprintf() in order to avoid buffer overflows.
While of course safe, this is not strictly necessary as the maximum length of any edac_layer_name is 8 bytes.
drivers/edac/edac_mc.c:const char *edac_layer_name[] = { drivers/edac/edac_mc.c- [EDAC_MC_LAYER_BRANCH] = "branch", drivers/edac/edac_mc.c- [EDAC_MC_LAYER_CHANNEL] = "channel", drivers/edac/edac_mc.c- [EDAC_MC_LAYER_SLOT] = "slot", drivers/edac/edac_mc.c- [EDAC_MC_LAYER_CHIP_SELECT] = "csrow", drivers/edac/edac_mc.c- [EDAC_MC_LAYER_ALL_MEM] = "memory", drivers/edac/edac_mc.c-};
And name is:
char name[80];
I suppose name[80] could be changed to name[32] or so at the same time to reduce stack usage.
Maybe name should be moved into the loop too.
--- drivers/edac/debugfs.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-)
diff --git a/drivers/edac/debugfs.c b/drivers/edac/debugfs.c index 4804332d99465..a41071f2ad428 100644 --- a/drivers/edac/debugfs.c +++ b/drivers/edac/debugfs.c @@ -55,14 +55,15 @@ void edac_debugfs_exit(void) void edac_create_debugfs_nodes(struct mem_ctl_info *mci) { struct dentry *parent; - char name[80]; int i; parent = debugfs_create_dir(mci->dev.kobj.name, edac_debugfs); for (i = 0; i < mci->n_layers; i++) { - sprintf(name, "fake_inject_%s", - edac_layer_name[mci->layers[i].type]); + char name[32]; + + scnprintf(name, sizeof(name), "fake_inject_%s", + edac_layer_name[mci->layers[i].type]); debugfs_create_u8(name, S_IRUGO | S_IWUSR, parent, &mci->fake_inject_layer[i]); }
| |