Re: [PATCH] iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show

[Andy Shevchenko]

On Fri, Jul 17, 2026 at 04:00:24AM +0000, Babanpreet Singh wrote:
> ad3552r_hs_show_data_source_avail() formats the available data source
> names into a 128-byte stack buffer, but bounds each scnprintf() with
> PAGE_SIZE instead of the buffer size, so the bound does not protect
> the destination at all.
> 
> This cannot overflow today - dbgfs_attr_source[] has two entries,
> "normal" and "ramp-16bit", 18 bytes formatted - but the bound stops
> protecting the stack the day the table grows. Use sizeof(buf) so the
> bound matches the destination.
> 
> Found by smatch:
> 
>   drivers/iio/dac/ad3552r-hs.c:593 ad3552r_hs_show_data_source_avail()
>   error: scnprintf() 'buf[len]' too small (128 vs 4096)

Nice, but please use sysfs_emit_at() instead. This will fix the above issue as
well while moving towards the modern and recommended API.


-- 
With Best Regards,
Andy Shevchenko