[PATCH 2/2] cpu: hotplug: bound hotplug states sysfs output

[Bradley Morgan]

states_show() adds CPU hotplug state names into a single sysfs buffer
using sprintf(). With enough registered states, this can write past the
end of the PAGE_SIZE buffer.

Use sysfs_emit_at() so output is bounded.

Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Bradley Morgan <include@xxxxxxxxx>
---
 kernel/cpu.c | 7 +++----
 1 file changed, 3 insertions(+), 4 deletions(-)

diff --git a/kernel/cpu.c b/kernel/cpu.c
index 0f32086f9ed4..dec58e19329b 100644
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -2857,7 +2857,7 @@ static const struct attribute_group cpuhp_cpu_attr_group = {
 static ssize_t states_show(struct device *dev,
 				 struct device_attribute *attr, char *buf)
 {
-	ssize_t cur, res = 0;
+	ssize_t res = 0;
 	int i;
 
 	mutex_lock(&cpuhp_state_mutex);
@@ -2865,9 +2865,8 @@ static ssize_t states_show(struct device *dev,
 		struct cpuhp_step *sp = cpuhp_get_step(i);
 
 		if (sp->name) {
-			cur = sprintf(buf, "%3d: %s\n", i, sp->name);
-			buf += cur;
-			res += cur;
+			res += sysfs_emit_at(buf, res, "%3d: %s\n",
+					     i, sp->name);
 		}
 	}
 	mutex_unlock(&cpuhp_state_mutex);
-- 
2.53.0