net: caif: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Cc: "David S . Miller" <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/caif/caif_spi.c b/drivers/net/caif/caif_spi.c
index 8e81bdf..63f2548 100644 (file)
--- a/drivers/net/caif/caif_spi.c
+++ b/drivers/net/caif/caif_spi.c
@@ -141,29 +141,29 @@ static ssize_t dbgfs_state(struct file *file, char __user *user_buf,
                return 0;
 
        /* Print out debug information. */
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "CAIF SPI debug information:\n");
-
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), FLAVOR);
-
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "STATE: %d\n", cfspi->dbg_state);
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Previous CMD: 0x%x\n", cfspi->pcmd);
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Current CMD: 0x%x\n", cfspi->cmd);
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Previous TX len: %d\n", cfspi->tx_ppck_len);
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Previous RX len: %d\n", cfspi->rx_ppck_len);
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Current TX len: %d\n", cfspi->tx_cpck_len);
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Current RX len: %d\n", cfspi->rx_cpck_len);
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Next TX len: %d\n", cfspi->tx_npck_len);
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Next RX len: %d\n", cfspi->rx_npck_len);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "CAIF SPI debug information:\n");
+
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len), FLAVOR);
+
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "STATE: %d\n", cfspi->dbg_state);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Previous CMD: 0x%x\n", cfspi->pcmd);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Current CMD: 0x%x\n", cfspi->cmd);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Previous TX len: %d\n", cfspi->tx_ppck_len);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Previous RX len: %d\n", cfspi->rx_ppck_len);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Current TX len: %d\n", cfspi->tx_cpck_len);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Current RX len: %d\n", cfspi->rx_cpck_len);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Next TX len: %d\n", cfspi->tx_npck_len);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Next RX len: %d\n", cfspi->rx_npck_len);
 
        if (len > DEBUGFS_BUF_SIZE)
                len = DEBUGFS_BUF_SIZE;
@@ -180,23 +180,23 @@ static ssize_t print_frame(char *buf, size_t size, char *frm,
        int len = 0;
        int i;
        for (i = 0; i < count; i++) {
-               len += snprintf((buf + len), (size - len),
+               len += scnprintf((buf + len), (size - len),
                                        "[0x" BYTE_HEX_FMT "]",
                                        frm[i]);
                if ((i == cut) && (count > (cut * 2))) {
                        /* Fast forward. */
                        i = count - cut;
-                       len += snprintf((buf + len), (size - len),
-                                       "--- %zu bytes skipped ---\n",
-                                       count - (cut * 2));
+                       len += scnprintf((buf + len), (size - len),
+                                        "--- %zu bytes skipped ---\n",
+                                        count - (cut * 2));
                }
 
                if ((!(i % 10)) && i) {
-                       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                                       "\n");
+                       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                                        "\n");
                }
        }
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len), "\n");
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len), "\n");
        return len;
 }
 
@@ -214,18 +214,18 @@ static ssize_t dbgfs_frame(struct file *file, char __user *user_buf,
                return 0;
 
        /* Print out debug information. */
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Current frame:\n");
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Current frame:\n");
 
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Tx data (Len: %d):\n", cfspi->tx_cpck_len);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Tx data (Len: %d):\n", cfspi->tx_cpck_len);
 
        len += print_frame((buf + len), (DEBUGFS_BUF_SIZE - len),
                           cfspi->xfer.va_tx[0],
                           (cfspi->tx_cpck_len + SPI_CMD_SZ), 100);
 
-       len += snprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
-                       "Rx data (Len: %d):\n", cfspi->rx_cpck_len);
+       len += scnprintf((buf + len), (DEBUGFS_BUF_SIZE - len),
+                        "Rx data (Len: %d):\n", cfspi->rx_cpck_len);
 
        len += print_frame((buf + len), (DEBUGFS_BUF_SIZE - len),
                           cfspi->xfer.va_rx,