Re: [PATCH v2] iio: dac: ad3552r-hs: use sysfs_emit_at() in data source avail show

[Andy Shevchenko]

On Sat, Jul 18, 2026 at 04:42:44AM +0000, Babanpreet Singh wrote:
> ad3552r_hs_show_data_source_avail() formats the available data source
> names into a 128-byte stack buffer, but bounds each scnprintf() with
> PAGE_SIZE instead of the buffer size, so the bound does not protect
> the destination at all.
> 
> This cannot overflow today - dbgfs_attr_source[] has two entries,
> "normal" and "ramp-16bit", 18 bytes formatted - but the bound stops
> protecting the stack the day the table grows.
> 
> Found by smatch:
> 
>   drivers/iio/dac/ad3552r-hs.c:593 ad3552r_hs_show_data_source_avail()
>   error: scnprintf() 'buf[len]' too small (128 vs 4096)

> Fixes: b1c5d68ea66e ("iio: dac: ad3552r-hs: add support for internal ramp")
> Suggested-by: Andy Shevchenko <andriy.shevchenko@xxxxxxxxx>

This whole thing is not what I suggested, I only had an idea of using
sysfs_emit_at(). BUT...

...

> static ssize_t ad3552r_hs_show_data_source_avail(struct file *f,
>  						 char __user *userbuf,

...I haven't paid attention that this is not sysfs attribute handling
in the default way, this is customized one and the passed buffer is
in user space.

>  						 size_t count, loff_t *ppos)

Hence the correct fix is just replace PAGE_SIZE with sizeof(buf) as it was
I suppose in v1. Sorry for my mistake.

-- 
With Best Regards,
Andy Shevchenko