Messages in this thread Patch in this message | | | Date | Wed, 16 Sep 2020 19:00:52 +0200 | From | Borislav Petkov <> | Subject | Re: [PATCH v2] EDAC/mc_sysfs: Add missing newlines when printing {max,dimm}_location |
| |
On Mon, Sep 14, 2020 at 10:48:54AM +0800, Xiongfeng Wang wrote: > @@ -813,15 +817,21 @@ static ssize_t mci_max_location_show(struct device *dev, > char *data) > { > struct mem_ctl_info *mci = to_mci(dev); > - int i; > + int i, n; > char *p = data; > + unsigned int len = PAGE_SIZE; > > for (i = 0; i < mci->n_layers; i++) { > - p += sprintf(p, "%s %d ", > + n = snprintf(p, len, "%s %d ", > edac_layer_name[mci->layers[i].type], > mci->layers[i].size - 1); > + p += n; > + len -= n;
What happens if that subtraction causes len to wrap around and become a huge positive unsigned integer?
> + if (!len)
Would that test still work?
IOW, I did this to your patch ontop. Note that I've moved the "p" pointer incrementation after the length check so that the pointer doesn't overflow too:
--- diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c index bf0e075fb635..fa0551c81e63 100644 --- a/drivers/edac/edac_mc_sysfs.c +++ b/drivers/edac/edac_mc_sysfs.c @@ -817,19 +817,22 @@ static ssize_t mci_max_location_show(struct device *dev, char *data) { struct mem_ctl_info *mci = to_mci(dev); - int i, n; + int len = PAGE_SIZE; char *p = data; - unsigned int len = PAGE_SIZE; + int i, n; for (i = 0; i < mci->n_layers; i++) { n = snprintf(p, len, "%s %d ", edac_layer_name[mci->layers[i].type], mci->layers[i].size - 1); - p += n; + len -= n; - if (!len) + if (len < 0) goto out; + + p += n; } + p += snprintf(p, len, "\n"); out: return p - data; -- Regards/Gruss, Boris.
https://people.kernel.org/tglx/notes-about-netiquette
| |