f2fs: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Reviewed-by: Chao Yu <yuchao0@huawei.com>
Signed-off-by: Jaegeuk Kim <jaegeuk@kernel.org>

diff --git a/fs/f2fs/sysfs.c b/fs/f2fs/sysfs.c
index 91d6497..5cc58a1 100644 (file)
--- a/fs/f2fs/sysfs.c
+++ b/fs/f2fs/sysfs.c
@@ -109,47 +109,47 @@ static ssize_t features_show(struct f2fs_attr *a,
                return sprintf(buf, "0\n");
 
        if (f2fs_sb_has_encrypt(sbi))
-               len += snprintf(buf, PAGE_SIZE - len, "%s",
+               len += scnprintf(buf, PAGE_SIZE - len, "%s",
                                                "encryption");
        if (f2fs_sb_has_blkzoned(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "blkzoned");
        if (f2fs_sb_has_extra_attr(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "extra_attr");
        if (f2fs_sb_has_project_quota(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "projquota");
        if (f2fs_sb_has_inode_chksum(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "inode_checksum");
        if (f2fs_sb_has_flexible_inline_xattr(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "flexible_inline_xattr");
        if (f2fs_sb_has_quota_ino(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "quota_ino");
        if (f2fs_sb_has_inode_crtime(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "inode_crtime");
        if (f2fs_sb_has_lost_found(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "lost_found");
        if (f2fs_sb_has_verity(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "verity");
        if (f2fs_sb_has_sb_chksum(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "sb_checksum");
        if (f2fs_sb_has_casefold(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "casefold");
        if (f2fs_sb_has_compression(sbi))
-               len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+               len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "compression");
-       len += snprintf(buf + len, PAGE_SIZE - len, "%s%s",
+       len += scnprintf(buf + len, PAGE_SIZE - len, "%s%s",
                                len ? ", " : "", "pin_file");
-       len += snprintf(buf + len, PAGE_SIZE - len, "\n");
+       len += scnprintf(buf + len, PAGE_SIZE - len, "\n");
        return len;
 }
 
@@ -233,16 +233,16 @@ static ssize_t f2fs_sbi_show(struct f2fs_attr *a,
                int hot_count = sbi->raw_super->hot_ext_count;
                int len = 0, i;
 
-               len += snprintf(buf + len, PAGE_SIZE - len,
+               len += scnprintf(buf + len, PAGE_SIZE - len,
                                                "cold file extension:\n");
                for (i = 0; i < cold_count; i++)
-                       len += snprintf(buf + len, PAGE_SIZE - len, "%s\n",
+                       len += scnprintf(buf + len, PAGE_SIZE - len, "%s\n",
                                                                extlist[i]);
 
-               len += snprintf(buf + len, PAGE_SIZE - len,
+               len += scnprintf(buf + len, PAGE_SIZE - len,
                                                "hot file extension:\n");
                for (i = cold_count; i < cold_count + hot_count; i++)
-                       len += snprintf(buf + len, PAGE_SIZE - len, "%s\n",
+                       len += scnprintf(buf + len, PAGE_SIZE - len, "%s\n",
                                                                extlist[i]);
                return len;
        }