Hi ,
On 2020/9/17 1:00, Borislav Petkov wrote:
> On Mon, Sep 14, 2020 at 10:48:54AM +0800, Xiongfeng Wang wrote:
>> @@ -813,15 +817,21 @@ static ssize_t mci_max_location_show(struct device
>> *dev,
>> char *data)
>> {
>> struct mem_ctl_info *mci = to_mci(dev);
>> - int i;
>> + int i, n;
>> char *p = data;
>> + unsigned int len = PAGE_SIZE;
>>
>> for (i = 0; i < mci->n_layers; i++) {
>> - p += sprintf(p, "%s %d ",
>> + n = snprintf(p, len, "%s %d ",
>> edac_layer_name[mci->layers[i].type],
>> mci->layers[i].size - 1);
>> + p += n;
>> + len -= n;
>
> What happens if that subtraction causes len to wrap around and become a
> huge positive unsigned integer?
>
>> + if (!len)
>
> Would that test still work?
I am not sure if snprintf will return a value larger than its second input
paramter 'size'. But we can also check if 'len' is less than 0. It's better.
>
> IOW, I did this to your patch ontop. Note that I've moved the "p"
> pointer incrementation after the length check so that the pointer
> doesn't overflow too:
Thanks. I will add it in the next version.
>
> ---
> diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
> index bf0e075fb635..fa0551c81e63 100644
> --- a/drivers/edac/edac_mc_sysfs.c
> +++ b/drivers/edac/edac_mc_sysfs.c
> @@ -817,19 +817,22 @@ static ssize_t mci_max_location_show(struct device *dev,
> char *data)
> {
> struct mem_ctl_info *mci = to_mci(dev);
> - int i, n;
> + int len = PAGE_SIZE;
> char *p = data;
> - unsigned int len = PAGE_SIZE;
> + int i, n;
>
> for (i = 0; i < mci->n_layers; i++) {
> n = snprintf(p, len, "%s %d ",
> edac_layer_name[mci->layers[i].type],
> mci->layers[i].size - 1);
> - p += n;
> +
> len -= n;
> - if (!len)
> + if (len < 0)
Not sure whether we need to check 'len' equals to 0.
if (len <= 0) ?
> goto out;
> +
> + p += n;
> }
> +
> p += snprintf(p, len, "\n");
> out:
> return p - data;
>
Thanks,
XIongfeng
