Re: [PATCH v4 1/3] platform/mellanox: mlxbf-pmc: Fix potential buffer overflows

[Hans de Goede]

Hi,

On 9/5/23 14:49, Shravan Kumar Ramani wrote:
> Replace sprintf with sysfs_emit where possible.
> Size check in mlxbf_pmc_event_list_show should account for "\0".
> 
> Fixes: 1a218d312e65 ("platform/mellanox: mlxbf-pmc: Add Mellanox BlueField PMC driver")
> Signed-off-by: Shravan Kumar Ramani <shravankr@xxxxxxxxxx>
> Reviewed-by: Vadim Pasternak <vadimp@xxxxxxxxxx>
> Reviewed-by: David Thompson <davthompson@xxxxxxxxxx>

Thank you for your patch, I've applied this patch to my fixes
branch:
https://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86.git/log/?h=fixes

Note it will show up in my fixes branch once I've pushed my
local branch there, which might take a while.

I will include this patch in my next fixes pull-req to Linus
for the current kernel development cycle.

Regards,

Hans

> ---
>  drivers/platform/mellanox/mlxbf-pmc.c | 14 +++++++-------
>  1 file changed, 7 insertions(+), 7 deletions(-)
> 
> diff --git a/drivers/platform/mellanox/mlxbf-pmc.c b/drivers/platform/mellanox/mlxbf-pmc.c
> index be967d797c28..95afcae7b9fa 100644
> --- a/drivers/platform/mellanox/mlxbf-pmc.c
> +++ b/drivers/platform/mellanox/mlxbf-pmc.c
> @@ -1008,7 +1008,7 @@ static ssize_t mlxbf_pmc_counter_show(struct device *dev,
>  	} else
>  		return -EINVAL;
>  
> -	return sprintf(buf, "0x%llx\n", value);
> +	return sysfs_emit(buf, "0x%llx\n", value);
>  }
>  
>  /* Store function for "counter" sysfs files */
> @@ -1078,13 +1078,13 @@ static ssize_t mlxbf_pmc_event_show(struct device *dev,
>  
>  	err = mlxbf_pmc_read_event(blk_num, cnt_num, is_l3, &evt_num);
>  	if (err)
> -		return sprintf(buf, "No event being monitored\n");
> +		return sysfs_emit(buf, "No event being monitored\n");
>  
>  	evt_name = mlxbf_pmc_get_event_name(pmc->block_name[blk_num], evt_num);
>  	if (!evt_name)
>  		return -EINVAL;
>  
> -	return sprintf(buf, "0x%llx: %s\n", evt_num, evt_name);
> +	return sysfs_emit(buf, "0x%llx: %s\n", evt_num, evt_name);
>  }
>  
>  /* Store function for "event" sysfs files */
> @@ -1139,9 +1139,9 @@ static ssize_t mlxbf_pmc_event_list_show(struct device *dev,
>  		return -EINVAL;
>  
>  	for (i = 0, buf[0] = '\0'; i < size; ++i) {
> -		len += sprintf(e_info, "0x%x: %s\n", events[i].evt_num,
> -			       events[i].evt_name);
> -		if (len > PAGE_SIZE)
> +		len += snprintf(e_info, sizeof(e_info), "0x%x: %s\n",
> +				events[i].evt_num, events[i].evt_name);
> +		if (len >= PAGE_SIZE)
>  			break;
>  		strcat(buf, e_info);
>  		ret = len;
> @@ -1168,7 +1168,7 @@ static ssize_t mlxbf_pmc_enable_show(struct device *dev,
>  
>  	value = FIELD_GET(MLXBF_PMC_L3C_PERF_CNT_CFG_EN, perfcnt_cfg);
>  
> -	return sprintf(buf, "%d\n", value);
> +	return sysfs_emit(buf, "%d\n", value);
>  }
>  
>  /* Store function for "enable" sysfs files - only for l3cache */