From: Bjorn Helgaas Fix pci_name_bus() so it can't overflow caller's buffer. Noticed by David Mosberger. Signed-off-by: Bjorn Helgaas Signed-off-by: Andrew Morton --- 25-akpm/arch/ppc64/kernel/pci.c | 6 +++--- 25-akpm/arch/sparc64/kernel/pci.c | 4 ++-- 25-akpm/drivers/pci/proc.c | 2 +- 25-akpm/include/asm-alpha/pci.h | 6 +++--- 25-akpm/include/asm-ia64/pci.h | 6 +++--- 25-akpm/include/asm-mips/pci.h | 6 +++--- 25-akpm/include/asm-ppc/pci.h | 4 ++-- 25-akpm/include/asm-ppc64/pci.h | 2 +- 25-akpm/include/asm-sparc64/pci.h | 2 +- 25-akpm/include/linux/pci.h | 4 ++-- 10 files changed, 21 insertions(+), 21 deletions(-) diff -puN arch/ppc64/kernel/pci.c~prevent-pci_name_bus-buffer-overflows arch/ppc64/kernel/pci.c --- 25/arch/ppc64/kernel/pci.c~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/arch/ppc64/kernel/pci.c Fri Jan 14 15:31:56 2005 @@ -301,16 +301,16 @@ int pci_domain_nr(struct pci_bus *bus) EXPORT_SYMBOL(pci_domain_nr); /* Set the name of the bus as it appears in /proc/bus/pci */ -int pci_name_bus(char *name, struct pci_bus *bus) +int pci_name_bus(char *name, size_t size, struct pci_bus *bus) { #ifndef CONFIG_PPC_ISERIES struct pci_controller *hose = pci_bus_to_host(bus); if (hose->buid) - sprintf(name, "%04x:%02x", pci_domain_nr(bus), bus->number); + snprintf(name, size, "%04x:%02x", pci_domain_nr(bus), bus->number); else #endif - sprintf(name, "%02x", bus->number); + snprintf(name, size, "%02x", bus->number); return 0; } diff -puN arch/sparc64/kernel/pci.c~prevent-pci_name_bus-buffer-overflows arch/sparc64/kernel/pci.c --- 25/arch/sparc64/kernel/pci.c~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/arch/sparc64/kernel/pci.c Fri Jan 14 15:31:56 2005 @@ -794,9 +794,9 @@ int pci_domain_nr(struct pci_bus *pbus) } EXPORT_SYMBOL(pci_domain_nr); -int pci_name_bus(char *name, struct pci_bus *bus) +int pci_name_bus(char *name, size_t size, struct pci_bus *bus) { - sprintf(name, "%04x:%02x", pci_domain_nr(bus), bus->number); + snprintf(name, size, "%04x:%02x", pci_domain_nr(bus), bus->number); return 0; } diff -puN drivers/pci/proc.c~prevent-pci_name_bus-buffer-overflows drivers/pci/proc.c --- 25/drivers/pci/proc.c~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/drivers/pci/proc.c Fri Jan 14 15:31:56 2005 @@ -391,7 +391,7 @@ int pci_proc_attach_device(struct pci_de return -EACCES; if (!(de = bus->procdir)) { - if (pci_name_bus(name, bus)) + if (pci_name_bus(name, sizeof(name), bus)) return -EEXIST; de = bus->procdir = proc_mkdir(name, proc_bus_pci_dir); if (!de) diff -puN include/asm-alpha/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-alpha/pci.h --- 25/include/asm-alpha/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/include/asm-alpha/pci.h Fri Jan 14 15:31:56 2005 @@ -229,14 +229,14 @@ extern void pcibios_resource_to_bus(stru #define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index static inline int -pci_name_bus(char *name, struct pci_bus *bus) +pci_name_bus(char *name, size_t size, struct pci_bus *bus) { struct pci_controller *hose = bus->sysdata; if (likely(hose->need_domain_info == 0)) { - sprintf(name, "%02x", bus->number); + snprintf(name, size, "%02x", bus->number); } else { - sprintf(name, "%04x:%02x", hose->index, bus->number); + snprintf(name, size, "%04x:%02x", hose->index, bus->number); } return 0; } diff -puN include/asm-ia64/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-ia64/pci.h --- 25/include/asm-ia64/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/include/asm-ia64/pci.h Fri Jan 14 15:31:56 2005 @@ -121,12 +121,12 @@ struct pci_controller { extern struct pci_ops pci_root_ops; -static inline int pci_name_bus(char *name, struct pci_bus *bus) +static inline int pci_name_bus(char *name, size_t size, struct pci_bus *bus) { if (pci_domain_nr(bus) == 0) { - sprintf(name, "%02x", bus->number); + snprintf(name, size, "%02x", bus->number); } else { - sprintf(name, "%04x:%02x", pci_domain_nr(bus), bus->number); + snprintf(name, size, "%04x:%02x", pci_domain_nr(bus), bus->number); } return 0; } diff -puN include/asm-mips/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-mips/pci.h --- 25/include/asm-mips/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/include/asm-mips/pci.h Fri Jan 14 15:31:56 2005 @@ -138,14 +138,14 @@ extern void pcibios_resource_to_bus(stru #define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index static inline int -pci_name_bus(char *name, struct pci_bus *bus) +pci_name_bus(char *name, size_t size, struct pci_bus *bus) { struct pci_controller *hose = bus->sysdata; if (likely(hose->need_domain_info == 0)) { - sprintf(name, "%02x", bus->number); + snprintf(name, size, "%02x", bus->number); } else { - sprintf(name, "%04x:%02x", hose->index, bus->number); + snprintf(name, size, "%04x:%02x", hose->index, bus->number); } return 0; } diff -puN include/asm-ppc64/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-ppc64/pci.h --- 25/include/asm-ppc64/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/include/asm-ppc64/pci.h Fri Jan 14 15:31:56 2005 @@ -191,7 +191,7 @@ static inline int pci_dma_mapping_error( extern int pci_domain_nr(struct pci_bus *bus); /* Set the name of the bus as it appears in /proc/bus/pci */ -extern int pci_name_bus(char *name, struct pci_bus *bus); +extern int pci_name_bus(char *name, size_t size, struct pci_bus *bus); struct vm_area_struct; /* Map a range of PCI memory or I/O space for a device into user space */ diff -puN include/asm-ppc/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-ppc/pci.h --- 25/include/asm-ppc/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/include/asm-ppc/pci.h Fri Jan 14 15:31:56 2005 @@ -79,9 +79,9 @@ extern unsigned long pci_bus_to_phys(uns #define pci_domain_nr(bus) ((struct pci_controller *)(bus)->sysdata)->index /* Set the name of the bus as it appears in /proc/bus/pci */ -static inline int pci_name_bus(char *name, struct pci_bus *bus) +static inline int pci_name_bus(char *name, size_t size, struct pci_bus *bus) { - sprintf(name, "%02x", bus->number); + snprintf(name, size, "%02x", bus->number); return 0; } diff -puN include/asm-sparc64/pci.h~prevent-pci_name_bus-buffer-overflows include/asm-sparc64/pci.h --- 25/include/asm-sparc64/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/include/asm-sparc64/pci.h Fri Jan 14 15:31:56 2005 @@ -223,7 +223,7 @@ static inline int pci_dma_mapping_error( /* Return the index of the PCI controller for device PDEV. */ extern int pci_domain_nr(struct pci_bus *bus); -extern int pci_name_bus(char *name, struct pci_bus *bus); +extern int pci_name_bus(char *name, size_t size, struct pci_bus *bus); /* Platform support for /proc/bus/pci/X/Y mmap()s. */ diff -puN include/linux/pci.h~prevent-pci_name_bus-buffer-overflows include/linux/pci.h --- 25/include/linux/pci.h~prevent-pci_name_bus-buffer-overflows Fri Jan 14 15:31:56 2005 +++ 25-akpm/include/linux/pci.h Fri Jan 14 15:31:56 2005 @@ -966,9 +966,9 @@ static inline int pci_enable_wake(struct */ #ifndef CONFIG_PCI_DOMAINS static inline int pci_domain_nr(struct pci_bus *bus) { return 0; } -static inline int pci_name_bus(char *name, struct pci_bus *bus) +static inline int pci_name_bus(char *name, size_t size, struct pci_bus *bus) { - sprintf(name, "%02x", bus->number); + snprintf(name, size, "%02x", bus->number); return 0; } #endif _