On Thu, 2020-09-17 at 19:38 +0800, Xiongfeng Wang wrote:
> On 2020/9/17 1:00, Borislav Petkov wrote:
> > On Mon, Sep 14, 2020 at 10:48:54AM +0800, Xiongfeng Wang wrote:
> > > @@ -813,15 +817,21 @@ static ssize_t mci_max_location_show(struct device
> > > *dev,
> > > char *data)
> > > {
> > > struct mem_ctl_info *mci = to_mci(dev);
> > > - int i;
> > > + int i, n;
> > > char *p = data;
> > > + unsigned int len = PAGE_SIZE;
> > >
> > > for (i = 0; i < mci->n_layers; i++) {
> > > - p += sprintf(p, "%s %d ",
> > > + n = snprintf(p, len, "%s %d ",
> > > edac_layer_name[mci->layers[i].type],
> > > mci->layers[i].size - 1);
> > > + p += n;
> > > + len -= n;
> >
> > What happens if that subtraction causes len to wrap around and become a
> > huge positive unsigned integer?
If you're really concerned about wrapping, use scnprintf.
