Commit 413ae546 authored by Takashi Iwai's avatar Takashi Iwai Committed by David S. Miller
Browse files

net: nfp: Use scnprintf() for avoiding potential buffer overflow 



Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Reviewed-by: default avatarSimon Horman <simon.horman@netronome.com>
Cc: "David S . Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: oss-drivers@netronome.com
To: netdev@vger.kernel.org
Signed-off-by: default avatarTakashi Iwai <tiwai@suse.de>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4a348601

drivers/net/ethernet/netronome/nfp/nfpcore/nfp6000_pcie.c

+4 −4
Original line number Original line Diff line number Diff line
@@ -616,7 +616,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface) 
	if (bar->iomem) {

	if (bar->iomem) {

		int pf;

		int pf;





		msg += snprintf(msg, end - msg,	"0.0: General/MSI-X SRAM, ");

		msg += scnprintf(msg, end - msg, "0.0: General/MSI-X SRAM, ");

		atomic_inc(&bar->refcnt);

		atomic_inc(&bar->refcnt);

		bars_free--;

		bars_free--;
@@ -661,7 +661,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface) 




	/* Configure, and lock, BAR0.1 for PCIe XPB (MSI-X PBA) */

	/* Configure, and lock, BAR0.1 for PCIe XPB (MSI-X PBA) */

	bar = &nfp->bar[1];

	bar = &nfp->bar[1];

	msg += snprintf(msg, end - msg, "0.1: PCIe XPB/MSI-X PBA, ");

	msg += scnprintf(msg, end - msg, "0.1: PCIe XPB/MSI-X PBA, ");

	atomic_inc(&bar->refcnt);

	atomic_inc(&bar->refcnt);

	bars_free--;

	bars_free--;
@@ -680,7 +680,7 @@ static int enable_bars(struct nfp6000_pcie *nfp, u16 interface) 
		bar->iomem = ioremap(nfp_bar_resource_start(bar),

		bar->iomem = ioremap(nfp_bar_resource_start(bar),

					     nfp_bar_resource_len(bar));

					     nfp_bar_resource_len(bar));

		if (bar->iomem) {

		if (bar->iomem) {

			msg += snprintf(msg, end - msg,

			msg += scnprintf(msg, end - msg,

					 "0.%d: Explicit%d, ", 4 + i, i);

					 "0.%d: Explicit%d, ", 4 + i, i);

			atomic_inc(&bar->refcnt);

			atomic_inc(&bar->refcnt);

			bars_free--;

			bars_free--;