On Mon, Sep 14, 2020 at 10:48:54AM +0800, Xiongfeng Wang wrote:
> @@ -813,15 +817,21 @@ static ssize_t mci_max_location_show(struct device *dev,
> char *data)
> {
> struct mem_ctl_info *mci = to_mci(dev);
> - int i;
> + int i, n;
> char *p = data;
> + unsigned int len = PAGE_SIZE;
>
> for (i = 0; i < mci->n_layers; i++) {
> - p += sprintf(p, "%s %d ",
> + n = snprintf(p, len, "%s %d ",
> edac_layer_name[mci->layers[i].type],
> mci->layers[i].size - 1);
> + p += n;
> + len -= n;
What happens if that subtraction causes len to wrap around and become a
huge positive unsigned integer?
> + if (!len)
Would that test still work?
IOW, I did this to your patch ontop. Note that I've moved the "p"
pointer incrementation after the length check so that the pointer
doesn't overflow too:
---
diff --git a/drivers/edac/edac_mc_sysfs.c b/drivers/edac/edac_mc_sysfs.c
index bf0e075fb635..fa0551c81e63 100644
--- a/drivers/edac/edac_mc_sysfs.c
+++ b/drivers/edac/edac_mc_sysfs.c
@@ -817,19 +817,22 @@ static ssize_t mci_max_location_show(struct device *dev,
char *data)
{
struct mem_ctl_info *mci = to_mci(dev);
- int i, n;
+ int len = PAGE_SIZE;
char *p = data;
- unsigned int len = PAGE_SIZE;
+ int i, n;
for (i = 0; i < mci->n_layers; i++) {
n = snprintf(p, len, "%s %d ",
edac_layer_name[mci->layers[i].type],
mci->layers[i].size - 1);
- p += n;
+
len -= n;
- if (!len)
+ if (len < 0)
goto out;
+
+ p += n;
}
+
p += snprintf(p, len, "\n");
out:
return p - data;
--
Regards/Gruss,
Boris.
https://people.kernel.org/tglx/notes-about-netiquette
