Commit 402dab54 authored by Dan Carpenter's avatar Dan Carpenter Committed by Guenter Roeck
Browse files

hwmon: (pmbus/max20730) use scnprintf() instead of snprintf() 



The snprintf() function returns the number of characters which would
have been printed if there were enough space, but the scnprintf()
returns the number of characters which were actually printed.  If the
buffer is not large enough, then using snprintf() would result in a
read overflow and an information leak.

Fixes: 8910c0bd ("hwmon: (pmbus/max20730) add device monitoring via debugfs")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: https://lore.kernel.org/r/20201022070824.GC2817762@mwanda


Signed-off-by: default avatarGuenter Roeck <linux@roeck-us.net>
parent 3650b228

drivers/hwmon/pmbus/max20730.c

+13 −13
Original line number Original line Diff line number Diff line
@@ -122,7 +122,7 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf, 
	switch (idx) {

	switch (idx) {

	case MAX20730_DEBUGFS_VOUT_MIN:

	case MAX20730_DEBUGFS_VOUT_MIN:

		ret = VOLT_FROM_REG(data->mfr_voutmin * 10000);

		ret = VOLT_FROM_REG(data->mfr_voutmin * 10000);

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d.%d\n",

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d.%d\n",

				ret / 10000, ret % 10000);

				ret / 10000, ret % 10000);

		break;

		break;

	case MAX20730_DEBUGFS_FREQUENCY:

	case MAX20730_DEBUGFS_FREQUENCY:
@@ -141,7 +141,7 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf, 
			ret = 800;

			ret = 800;

		else

		else

			ret = 900;

			ret = 900;

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		break;

		break;

	case MAX20730_DEBUGFS_PG_DELAY:

	case MAX20730_DEBUGFS_PG_DELAY:

		val = (data->mfr_devset1 & MAX20730_MFR_DEVSET1_TSTAT_MASK)

		val = (data->mfr_devset1 & MAX20730_MFR_DEVSET1_TSTAT_MASK)
@@ -223,7 +223,7 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf, 
	case MAX20730_DEBUGFS_OC_PROTECT_MODE:

	case MAX20730_DEBUGFS_OC_PROTECT_MODE:

		ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_OCPM_MASK)

		ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_OCPM_MASK)

			>> MAX20730_MFR_DEVSET2_OCPM_BIT_POS;

			>> MAX20730_MFR_DEVSET2_OCPM_BIT_POS;

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		break;

		break;

	case MAX20730_DEBUGFS_SS_TIMING:

	case MAX20730_DEBUGFS_SS_TIMING:

		val = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_SS_MASK)

		val = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_SS_MASK)
@@ -241,32 +241,32 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf, 
	case MAX20730_DEBUGFS_IMAX:

	case MAX20730_DEBUGFS_IMAX:

		ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_IMAX_MASK)

		ret = (data->mfr_devset2 & MAX20730_MFR_DEVSET2_IMAX_MASK)

			>> MAX20730_MFR_DEVSET2_IMAX_BIT_POS;

			>> MAX20730_MFR_DEVSET2_IMAX_BIT_POS;

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		break;

		break;

	case MAX20730_DEBUGFS_OPERATION:

	case MAX20730_DEBUGFS_OPERATION:

		ret = i2c_smbus_read_byte_data(psu->client, PMBUS_OPERATION);

		ret = i2c_smbus_read_byte_data(psu->client, PMBUS_OPERATION);

		if (ret < 0)

		if (ret < 0)

			return ret;

			return ret;

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		break;

		break;

	case MAX20730_DEBUGFS_ON_OFF_CONFIG:

	case MAX20730_DEBUGFS_ON_OFF_CONFIG:

		ret = i2c_smbus_read_byte_data(psu->client, PMBUS_ON_OFF_CONFIG);

		ret = i2c_smbus_read_byte_data(psu->client, PMBUS_ON_OFF_CONFIG);

		if (ret < 0)

		if (ret < 0)

			return ret;

			return ret;

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		break;

		break;

	case MAX20730_DEBUGFS_SMBALERT_MASK:

	case MAX20730_DEBUGFS_SMBALERT_MASK:

		ret = i2c_smbus_read_word_data(psu->client,

		ret = i2c_smbus_read_word_data(psu->client,

					       PMBUS_SMB_ALERT_MASK);

					       PMBUS_SMB_ALERT_MASK);

		if (ret < 0)

		if (ret < 0)

			return ret;

			return ret;

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		break;

		break;

	case MAX20730_DEBUGFS_VOUT_MODE:

	case MAX20730_DEBUGFS_VOUT_MODE:

		ret = i2c_smbus_read_byte_data(psu->client, PMBUS_VOUT_MODE);

		ret = i2c_smbus_read_byte_data(psu->client, PMBUS_VOUT_MODE);

		if (ret < 0)

		if (ret < 0)

			return ret;

			return ret;

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX, "%d\n", ret);

		break;

		break;

	case MAX20730_DEBUGFS_VOUT_COMMAND:

	case MAX20730_DEBUGFS_VOUT_COMMAND:

		ret = i2c_smbus_read_word_data(psu->client, PMBUS_VOUT_COMMAND);

		ret = i2c_smbus_read_word_data(psu->client, PMBUS_VOUT_COMMAND);
@@ -274,7 +274,7 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf, 
			return ret;

			return ret;





		ret = VOLT_FROM_REG(ret * 10000);

		ret = VOLT_FROM_REG(ret * 10000);

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX,

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX,

				"%d.%d\n", ret / 10000, ret % 10000);

				"%d.%d\n", ret / 10000, ret % 10000);

		break;

		break;

	case MAX20730_DEBUGFS_VOUT_MAX:

	case MAX20730_DEBUGFS_VOUT_MAX:
@@ -283,7 +283,7 @@ static ssize_t max20730_debugfs_read(struct file *file, char __user *buf, 
			return ret;

			return ret;





		ret = VOLT_FROM_REG(ret * 10000);

		ret = VOLT_FROM_REG(ret * 10000);

		len = snprintf(tbuf, DEBUG_FS_DATA_MAX,

		len = scnprintf(tbuf, DEBUG_FS_DATA_MAX,

				"%d.%d\n", ret / 10000, ret % 10000);

				"%d.%d\n", ret / 10000, ret % 10000);

		break;

		break;

	default:

	default: