The drc-name-prefix field of ibm,drc-info is supplied by firmware and
is not limited to fit within MAX_DRC_NAME_LEN. Using sprintf() to append
a suffix can therefore overflow the stack buffers used for DRC names.
Use snprintf() and reject names that would be truncated.
Fixes: 2fcf3ae508c2 ("hotplug/drc-info: Add code to search ibm,drc-info
property")
Cc: [email protected]
Signed-off-by: Yudi Yang <[email protected]>
---
drivers/pci/hotplug/rpaphp_core.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/hotplug/rpaphp_core.c
b/drivers/pci/hotplug/rpaphp_core.c
index 2316de0fd198..39109a50fee6 100644
--- a/drivers/pci/hotplug/rpaphp_core.c
+++ b/drivers/pci/hotplug/rpaphp_core.c
@@ -252,8 +252,11 @@ static int rpaphp_check_drc_props_v2(struct device_node
*dn, char *drc_name,
/* Found it */
if (my_index >= drc.drc_index_start && my_index <=
drc.last_drc_index) {
int index = my_index - drc.drc_index_start;
- sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix,
- drc.drc_name_suffix_start + index);
+
+ if (snprintf(cell_drc_name, sizeof(cell_drc_name),
"%s%u",
+ drc.drc_name_prefix,
+ drc.drc_name_suffix_start + index) >=
sizeof(cell_drc_name))
+ return -EINVAL;
break;
}
}
@@ -355,7 +358,9 @@ static int rpaphp_drc_info_add_slot(struct device_node *dn)
if (!is_php_type(drc.drc_type))
return 0;
- sprintf(drc_name, "%s%d", drc.drc_name_prefix,
drc.drc_name_suffix_start);
+ if (snprintf(drc_name, sizeof(drc_name), "%s%u", drc.drc_name_prefix,
+ drc.drc_name_suffix_start) >= sizeof(drc_name))
+ return -EINVAL;
slot = alloc_slot_struct(dn, drc.drc_index_start, drc_name,
drc.drc_power_domain);
if (!slot)
--
2.43.0
