From 5e2cb1018a8a583b83d56c80f46507da6f3f2b57 Mon Sep 17 00:00:00 2001 From: Miao Xie Date: Wed, 6 Feb 2008 01:36:53 -0800 Subject: time: fix sysfs_show_{available,current}_clocksources() buffer overflow problem I found that there is a buffer overflow problem in the following code. Version: 2.6.24-rc2, File: kernel/time/clocksource.c:417-432 -------------------------------------------------------------------- static ssize_t sysfs_show_available_clocksources(struct sys_device *dev, char *buf) { struct clocksource *src; char *curr = buf; spin_lock_irq(&clocksource_lock); list_for_each_entry(src, &clocksource_list, list) { curr += sprintf(curr, "%s ", src->name); } spin_unlock_irq(&clocksource_lock); curr += sprintf(curr, "\n"); return curr - buf; } ----------------------------------------------------------------------- sysfs_show_current_clocksources() also has the same problem though in practice the size of current clocksource's name won't exceed PAGE_SIZE. I fix the bug by using snprintf according to the specification of the kernel (Version:2.6.24-rc2,File:Documentation/filesystems/sysfs.txt) Fix sysfs_show_available_clocksources() and sysfs_show_current_clocksources() buffer overflow problem with snprintf(). Signed-off-by: Miao Xie Cc: WANG Cong Cc: Thomas Gleixner Cc: john stultz Signed-off-by: Andrew Morton Signed-off-by: Linus Torvalds --- kernel/time/clocksource.c | 19 ++++++++++--------- 1 file changed, 10 insertions(+), 9 deletions(-) (limited to 'kernel/time/clocksource.c') diff --git a/kernel/time/clocksource.c b/kernel/time/clocksource.c index 6e9259a5d501..81afb3927ecc 100644 --- a/kernel/time/clocksource.c +++ b/kernel/time/clocksource.c @@ -363,15 +363,13 @@ void clocksource_unregister(struct clocksource *cs) static ssize_t sysfs_show_current_clocksources(struct sys_device *dev, char *buf) { - char *curr = buf; + ssize_t count = 0; spin_lock_irq(&clocksource_lock); - curr += sprintf(curr, "%s ", curr_clocksource->name); + count = snprintf(buf, PAGE_SIZE, "%s\n", curr_clocksource->name); spin_unlock_irq(&clocksource_lock); - curr += sprintf(curr, "\n"); - - return curr - buf; + return count; } /** @@ -439,17 +437,20 @@ static ssize_t sysfs_show_available_clocksources(struct sys_device *dev, char *buf) { struct clocksource *src; - char *curr = buf; + ssize_t count = 0; spin_lock_irq(&clocksource_lock); list_for_each_entry(src, &clocksource_list, list) { - curr += sprintf(curr, "%s ", src->name); + count += snprintf(buf + count, + max((ssize_t)PAGE_SIZE - count, (ssize_t)0), + "%s ", src->name); } spin_unlock_irq(&clocksource_lock); - curr += sprintf(curr, "\n"); + count += snprintf(buf + count, + max((ssize_t)PAGE_SIZE - count, (ssize_t)0), "\n"); - return curr - buf; + return count; } /* -- cgit v1.2.3