From: Bjorn Helgaas <bjorn.helgaas@hp.com>
Fix pci_name_bus() so it can't overflow caller's buffer. Noticed by David
Mosberger.
Signed-off-by: Bjorn Helgaas <bjorn.helgaas@hp.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---
25-akpm/arch/ppc64/kernel/pci.c | 6 +++---
25-akpm/arch/sparc64/kernel/pci.c | 4 ++--
25-akpm/drivers/pci/proc.c | 2 +-
25-akpm/include/asm-alpha/pci.h | 6 +++---
25-akpm/include/asm-ia64/pci.h | 6 +++---
25-akpm/include/asm-mips/pci.h | 6 +++---
25-akpm/include/asm-ppc/pci.h | 4 ++--
25-akpm/include/asm-ppc64/pci.h | 2 +-
25-akpm/include/asm-sparc64/pci.h | 2 +-
25-akpm/include/linux/pci.h | 4 ++--
10 files changed, 21 insertions(+), 21 deletions(-)
diff -puN arch/ppc64/kernel/pci.c~prevent-pci_name_bus-buffer-overflows arch/ppc64/kernel/pci.c
--- 25/arch/ppc64/kernel/pci.c~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/arch/ppc64/kernel/pci.c Fri Jan 14 15:31:56 2005
@@ -301,16 +301,16 @@ int pci_domain_nr(struct pci_bus *bus)
EXPORT_SYMBOL(pci_domain_nr);
/* Set the name of the bus as it appears in /proc/bus/pci */
-int pci_name_bus(char *name, struct pci_bus *bus)
+int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
{
#ifndef CONFIG_PPC_ISERIES
struct pci_controller *hose = pci_bus_to_host(bus);
if (hose->buid)
- sprintf(name, "%04x:%02x", pci_domain_nr(bus), bus->number);
+ snprintf(name, size, "%04x:%02x", pci_domain_nr(bus), bus->number);
else
#endif
- sprintf(name, "%02x", bus->number);
+ snprintf(name, size, "%02x", bus->number);
return 0;
}
diff -puN arch/sparc64/kernel/pci.c~prevent-pci_name_bus-buffer-overflows arch/sparc64/kernel/pci.c
--- 25/arch/sparc64/kernel/pci.c~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/arch/sparc64/kernel/pci.c Fri Jan 14 15:31:56 2005
@@ -794,9 +794,9 @@ int pci_domain_nr(struct pci_bus *pbus)
}
EXPORT_SYMBOL(pci_domain_nr);
-int pci_name_bus(char *name, struct pci_bus *bus)
+int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
{
- sprintf(name, "%04x:%02x", pci_domain_nr(bus), bus->number);
+ snprintf(name, size, "%04x:%02x", pci_domain_nr(bus), bus->number);
return 0;
}
diff -puN drivers/pci/proc.c~prevent-pci_name_bus-buffer-overflows drivers/pci/proc.c
--- 25/drivers/pci/proc.c~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/drivers/pci/proc.c Fri Jan 14 15:31:56 2005
@@ -391,7 +391,7 @@ int pci_proc_attach_device(struct pci_de
return -EACCES;
if (!(de = bus->procdir)) {
- if (pci_name_bus(name, bus))
+ if (pci_name_bus(name, sizeof(name), bus))
return -EEXIST;
de = bus->procdir = proc_mkdir(name, proc_bus_pci_dir);
if (!de)
diff -puN include/asm-alpha/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-alpha/pci.h
--- 25/include/asm-alpha/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/include/asm-alpha/pci.h Fri Jan 14 15:31:56 2005
@@ -229,14 +229,14 @@ extern void pcibios_resource_to_bus(stru
#define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index
static inline int
-pci_name_bus(char *name, struct pci_bus *bus)
+pci_name_bus(char *name, size_t size, struct pci_bus *bus)
{
struct pci_controller *hose = bus->sysdata;
if (likely(hose->need_domain_info == 0)) {
- sprintf(name, "%02x", bus->number);
+ snprintf(name, size, "%02x", bus->number);
} else {
- sprintf(name, "%04x:%02x", hose->index, bus->number);
+ snprintf(name, size, "%04x:%02x", hose->index, bus->number);
}
return 0;
}
diff -puN include/asm-ia64/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-ia64/pci.h
--- 25/include/asm-ia64/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/include/asm-ia64/pci.h Fri Jan 14 15:31:56 2005
@@ -121,12 +121,12 @@ struct pci_controller {
extern struct pci_ops pci_root_ops;
-static inline int pci_name_bus(char *name, struct pci_bus *bus)
+static inline int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
{
if (pci_domain_nr(bus) == 0) {
- sprintf(name, "%02x", bus->number);
+ snprintf(name, size, "%02x", bus->number);
} else {
- sprintf(name, "%04x:%02x", pci_domain_nr(bus), bus->number);
+ snprintf(name, size, "%04x:%02x", pci_domain_nr(bus), bus->number);
}
return 0;
}
diff -puN include/asm-mips/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-mips/pci.h
--- 25/include/asm-mips/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/include/asm-mips/pci.h Fri Jan 14 15:31:56 2005
@@ -138,14 +138,14 @@ extern void pcibios_resource_to_bus(stru
#define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index
static inline int
-pci_name_bus(char *name, struct pci_bus *bus)
+pci_name_bus(char *name, size_t size, struct pci_bus *bus)
{
struct pci_controller *hose = bus->sysdata;
if (likely(hose->need_domain_info == 0)) {
- sprintf(name, "%02x", bus->number);
+ snprintf(name, size, "%02x", bus->number);
} else {
- sprintf(name, "%04x:%02x", hose->index, bus->number);
+ snprintf(name, size, "%04x:%02x", hose->index, bus->number);
}
return 0;
}
diff -puN include/asm-ppc64/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-ppc64/pci.h
--- 25/include/asm-ppc64/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/include/asm-ppc64/pci.h Fri Jan 14 15:31:56 2005
@@ -191,7 +191,7 @@ static inline int pci_dma_mapping_error(
extern int pci_domain_nr(struct pci_bus *bus);
/* Set the name of the bus as it appears in /proc/bus/pci */
-extern int pci_name_bus(char *name, struct pci_bus *bus);
+extern int pci_name_bus(char *name, size_t size, struct pci_bus *bus);
struct vm_area_struct;
/* Map a range of PCI memory or I/O space for a device into user space */
diff -puN include/asm-ppc/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-ppc/pci.h
--- 25/include/asm-ppc/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/include/asm-ppc/pci.h Fri Jan 14 15:31:56 2005
@@ -79,9 +79,9 @@ extern unsigned long pci_bus_to_phys(uns
#define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index
/* Set the name of the bus as it appears in /proc/bus/pci */
-static inline int pci_name_bus(char *name, struct pci_bus *bus)
+static inline int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
{
- sprintf(name, "%02x", bus->number);
+ snprintf(name, size, "%02x", bus->number);
return 0;
}
diff -puN include/asm-sparc64/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-sparc64/pci.h
--- 25/include/asm-sparc64/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/include/asm-sparc64/pci.h Fri Jan 14 15:31:56 2005
@@ -223,7 +223,7 @@ static inline int pci_dma_mapping_error(
/* Return the index of the PCI controller for device PDEV. */
extern int pci_domain_nr(struct pci_bus *bus);
-extern int pci_name_bus(char *name, struct pci_bus *bus);
+extern int pci_name_bus(char *name, size_t size, struct pci_bus *bus);
/* Platform support for /proc/bus/pci/X/Y mmap()s. */
diff -puN include/linux/pci.h~prevent-pci_name_bus-buffer-overflows include/linux/pci.h
--- 25/include/linux/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005
+++ 25-akpm/include/linux/pci.h Fri Jan 14 15:31:56 2005
@@ -966,9 +966,9 @@ static inline int pci_enable_wake(struct
*/
#ifndef CONFIG_PCI_DOMAINS
static inline int pci_domain_nr(struct pci_bus *bus) { return 0; }
-static inline int pci_name_bus(char *name, struct pci_bus *bus)
+static inline int pci_name_bus(char *name, size_t size, struct pci_bus *bus)
{
- sprintf(name, "%02x", bus->number);
+ snprintf(name, size, "%02x", bus->number);
return 0;
}
#endif
_