Re: [PATCH v2] EDAC/mc_sysfs: Add missing newlines when printing {max,dimm}_location

From: Borislav Petkov
Date: Wed Sep 16 2020 - 16:44:54 EST


On Mon, Sep 14, 2020 at 10:48:54AM +0800, Xiongfeng Wang wrote:
> @@ -813,15 +817,21 @@ static ssize_t mci_max_location_show(struct device *dev,
> char *data)
> {
> struct mem_ctl_info *mci = to_mci(dev);
> - int i;
> + int i, n;
> char *p = data;
> + unsigned int len = PAGE_SIZE;
>
> for (i = 0; i < mci->n_layers; i++) {
> - p += sprintf(p, "%s %d ",
> + n = snprintf(p, len, "%s %d ",
> edac_layer_name[mci->layers[i].type],
> mci->layers[i].size - 1);
> + p += n;
> + len -= n;

What happens if that subtraction causes len to wrap around and become a
huge positive unsigned integer?

> + if (!len)

Would that test still work?

IOW, I did this to your patch ontop. Note that I've moved the "p"
pointer incrementation after the length check so that the pointer
doesn't overflow too:

---
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index bf0e075fb635..fa0551c81e63 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -817,19 +817,22 @@ static ssize_t mci_max_location_show(struct device *dev,
char *data)
{
struct mem_ctl_info *mci = to_mci(dev);
- int i, n;
+ int len = PAGE_SIZE;
char *p = data;
- unsigned int len = PAGE_SIZE;
+ int i, n;

for (i = 0; i < mci->n_layers; i++) {
n = snprintf(p, len, "%s %d ",
edac_layer_name[mci->layers[i].type],
mci->layers[i].size - 1);
- p += n;
+
len -= n;
- if (!len)
+ if (len < 0)
goto out;
+
+ p += n;
}
+
p += snprintf(p, len, "\n");
out:
return p - data;

--
Regards/Gruss,
Boris.

https://people.kernel.org/tglx/notes-about-netiquette