prevent pci_name_bus() buffer overflows

PATCH New Bjorn Helgaas 1 participant 1 message Jan 14, 2005 PCI

lore

Share & tools

lore

Bjorn Helgaas

author

2005-01-14 20:40 UTC #0 lore raw

PATCH 1/1 prevent pci_name_bus() buffer overflows

Fix pci_name_bus() so it can't overflow caller's buffer. Noticed by David Mosberger.

Signed-off-by Bjorn Helgaas <[email protected]>

===== arch/ppc64/kernel/pci.c 1.62 vs edited =====

arch/ppc64/kernel/pci.c +3 -3

@@ -301,16 +301,16 @@
 EXPORT_SYMBOL(pci_domain_nr);
 
 /* Set the name of the bus as it appears in /proc/bus/pci */
-int pci_name_bus(char *name, struct pci_bus *bus)
+int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
 {
 #ifndef CONFIG_PPC_ISERIES
 	struct pci_controller *hose = pci_bus_to_host(bus);
 
 	if (hose->buid)
-		sprintf(name, "%04x:%02x", pci_domain_nr(bus), bus->number);
+		snprintf(name, size, "%04x:%02x", pci_domain_nr(bus), bus->number);
 	else
 #endif
-		sprintf(name, "%02x", bus->number);
+		snprintf(name, size, "%02x", bus->number);
 
 	return 0;
 }

===== arch/sparc64/kernel/pci.c 1.43 vs edited =====

arch/sparc64/kernel/pci.c +2 -2

@@ -794,9 +794,9 @@
 }
 EXPORT_SYMBOL(pci_domain_nr);
 
-int pci_name_bus(char *name, struct pci_bus *bus)
+int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
 {
-	sprintf(name, "%04x:%02x", pci_domain_nr(bus), bus->number);
+	snprintf(name, size, "%04x:%02x", pci_domain_nr(bus), bus->number);
 	return 0;
 }

===== drivers/pci/proc.c 1.41 vs edited =====

drivers/pci/proc.c +1 -1

@@ -391,7 +391,7 @@
 		return -EACCES;
 
 	if (!(de = bus->procdir)) {
-		if (pci_name_bus(name, bus))
+		if (pci_name_bus(name, sizeof(name), bus))
 			return -EEXIST;
 		de = bus->procdir = proc_mkdir(name, proc_bus_pci_dir);
 		if (!de)

===== include/asm-alpha/pci.h 1.23 vs edited =====

include/asm-alpha/pci.h +3 -3

@@ -229,14 +229,14 @@
 #define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index
 
 static inline int
-pci_name_bus(char *name, struct pci_bus *bus)
+pci_name_bus(char *name, size_t size, struct pci_bus *bus)
 {
 	struct pci_controller *hose = bus->sysdata;
 
 	if (likely(hose->need_domain_info == 0)) {
-		sprintf(name, "%02x", bus->number);
+		snprintf(name, size, "%02x", bus->number);
 	} else {
-		sprintf(name, "%04x:%02x", hose->index, bus->number);
+		snprintf(name, size, "%04x:%02x", hose->index, bus->number);
 	}
 	return 0;
 }

===== include/asm-ia64/pci.h 1.28 vs edited =====

include/asm-ia64/pci.h +3 -3

@@ -121,12 +121,12 @@
 
 extern struct pci_ops pci_root_ops;
 
-static inline int pci_name_bus(char *name, struct pci_bus *bus)
+static inline int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
 {
 	if (pci_domain_nr(bus) == 0) {
-		sprintf(name, "%02x", bus->number);
+		snprintf(name, size, "%02x", bus->number);
 	} else {
-		sprintf(name, "%04x:%02x", pci_domain_nr(bus), bus->number);
+		snprintf(name, size, "%04x:%02x", pci_domain_nr(bus), bus->number);
 	}
 	return 0;
 }

===== include/asm-mips/pci.h 1.19 vs edited =====

include/asm-mips/pci.h +3 -3

@@ -138,14 +138,14 @@
 #define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index
 
 static inline int
-pci_name_bus(char *name, struct pci_bus *bus)
+pci_name_bus(char *name, size_t size, struct pci_bus *bus)
 {
 	struct pci_controller *hose = bus->sysdata;
 
 	if (likely(hose->need_domain_info == 0)) {
-		sprintf(name, "%02x", bus->number);
+		snprintf(name, size, "%02x", bus->number);
 	} else {
-		sprintf(name, "%04x:%02x", hose->index, bus->number);
+		snprintf(name, size, "%04x:%02x", hose->index, bus->number);
 	}
 	return 0;
 }

===== include/asm-ppc/pci.h 1.29 vs edited =====

include/asm-ppc/pci.h +2 -2

@@ -79,9 +79,9 @@
 #define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index
 
 /* Set the name of the bus as it appears in /proc/bus/pci */
-static inline int pci_name_bus(char *name, struct pci_bus *bus)
+static inline int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
 {
-	sprintf(name, "%02x", bus->number);
+	snprintf(name, size, "%02x", bus->number);
 	return 0;
 }

===== include/asm-ppc64/pci.h 1.26 vs edited =====

include/asm-ppc64/pci.h +1 -1

@@ -191,7 +191,7 @@
 extern int pci_domain_nr(struct pci_bus *bus);
 
 /* Set the name of the bus as it appears in /proc/bus/pci */
-extern int pci_name_bus(char *name, struct pci_bus *bus);
+extern int pci_name_bus(char *name, size_t size, struct pci_bus *bus);
 
 struct vm_area_struct;
 /* Map a range of PCI memory or I/O space for a device into user space */

===== include/asm-sparc64/pci.h 1.23 vs edited =====

include/asm-sparc64/pci.h +1 -1

@@ -223,7 +223,7 @@
 /* Return the index of the PCI controller for device PDEV. */
 
 extern int pci_domain_nr(struct pci_bus *bus);
-extern int pci_name_bus(char *name, struct pci_bus *bus);
+extern int pci_name_bus(char *name, size_t size, struct pci_bus *bus);
 
 /* Platform support for /proc/bus/pci/X/Y mmap()s. */

===== include/linux/pci.h 1.147 vs edited =====

include/linux/pci.h +2 -2

@@ -966,9 +966,9 @@
  */
 #ifndef CONFIG_PCI_DOMAINS
 static inline int pci_domain_nr(struct pci_bus *bus) { return 0; }
-static inline int pci_name_bus(char *name, struct pci_bus *bus)
+static inline int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
 {
-	sprintf(name, "%02x", bus->number);
+	snprintf(name, size, "%02x", bus->number);
 	return 0;
 }
 #endif