Skip to contentSkip to conversation

mfd: snprintf() returns largish values

PATCH In review Dan Carpenter 2 participants 2 messages Aug 12, 2010 – Aug 13, 2010 Kernel janitors

lore
Share & tools
lore

Dan Carpenter

author
#0 lore raw

PATCH 1/1 mfd: snprintf() returns largish values

snprintf() returns the number of bytes which would have been written so it can be larger than the size of the buffer. In this case it's fine, but people copy and paste this code so I've fixed it.

Signed-off-by Dan Carpenter <[email protected]>
drivers/serial/mfd.c +6 -0
index bc9af50..5aa25e5 100644
@@ -171,6 +171,9 @@ static ssize_t port_show_regs(struct file *file, char __user *user_buf,
 	len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
 			"DIV: \t\t0x%08x\n", serial_in(up, UART_DIV));
 
+	if (len > HSU_REGS_BUFSIZE)
+		len = HSU_REGS_BUFSIZE;
+
 	ret =  simple_read_from_buffer(user_buf, count, ppos, buf, len);
 	kfree(buf);
 	return ret;

@@ -218,6 +221,9 @@ static ssize_t dma_show_regs(struct file *file, char __user *user_buf,
 	len += snprintf(buf + len, HSU_REGS_BUFSIZE - len,
 			"D0TSR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D3TSR));
 
+	if (len > HSU_REGS_BUFSIZE)
+		len = HSU_REGS_BUFSIZE;
+
 	ret =  simple_read_from_buffer(user_buf, count, ppos, buf, len);
 	kfree(buf);
 	return ret;
#1 lore raw
Quoted 28 lines · On Thu, 12 Aug 2010 15:50:09 +0800 Dan Carpenter <[email protected]> wrote:

snprintf() returns the number of bytes which would have been written so it can be larger than the size of the buffer. In this case it's fine, but people copy and paste this code so I've fixed it.

Signed-off-by Dan Carpenter <[email protected]>
drivers/serial/mfd.c +0 -0
index bc9af50..5aa25e5 100644
@@ -171,6 +171,9 @@ static ssize_t port_show_regs(struct file *file,

char __user *user_buf, len += snprintf(buf + len, HSU_REGS_BUFSIZE - len, "DIV: \t\t0x%08x\n", serial_in(up, UART_DIV));

drivers/serial/mfd.c +3 -0
+	if (len > HSU_REGS_BUFSIZE)
+		len = HSU_REGS_BUFSIZE;
+
 	ret =  simple_read_from_buffer(user_buf, count, ppos, buf,

len); kfree(buf);

drivers/serial/mfd.c +0 -0
 	return ret;

@@ -218,6 +221,9 @@ static ssize_t dma_show_regs(struct file *file,

char __user *user_buf, len += snprintf(buf + len, HSU_REGS_BUFSIZE - len, "D0TSR: \t\t0x%08x\n", chan_readl(chan, HSU_CH_D3TSR));

drivers/serial/mfd.c +3 -0
+	if (len > HSU_REGS_BUFSIZE)
+		len = HSU_REGS_BUFSIZE;
+
 	ret =  simple_read_from_buffer(user_buf, count, ppos, buf,
Quoted 2 lines

len); kfree(buf);
return ret;

Hi Carpenter,

It looks ok to me, thanks,

- Feng