[PATCH V2] regulator: core: fix constraints debug output

[PATCH V2] regulator: core: fix constraints debug output

[Stefan Wahren]

The line buffer for constraints debug isn't big enough to hold the output
in all cases. So fix the possible buffer overflow by the usage of the
scnprintf().

By the way this fixes that the debug output is overwritten
when uV_offset is greater 0.

Signed-off-by: Stefan Wahren <stefan.wahren@i2se.com>
CC: <stable@vger.kernel.org>
---
 drivers/regulator/core.c |   43 ++++++++++++++++++++++++-------------------
 1 file changed, 24 insertions(+), 19 deletions(-)

Changes in V2:
- add fix for buffer overflow which has been noticed by Joe Perches

diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index f698948..c19456e 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -780,58 +780,63 @@ static void print_constraints(struct regulator_dev *rdev)
 {
 	struct regulation_constraints *constraints = rdev->constraints;
 	char buf[80] = "";
+	size_t len = sizeof(buf) - 1;
 	int count = 0;
 	int ret;
 
 	if (constraints->min_uV && constraints->max_uV) {
 		if (constraints->min_uV == constraints->max_uV)
-			count += sprintf(buf + count, "%d mV ",
-					 constraints->min_uV / 1000);
+			count += scnprintf(buf + count, len - count, "%d mV ",
+					   constraints->min_uV / 1000);
 		else
-			count += sprintf(buf + count, "%d <--> %d mV ",
-					 constraints->min_uV / 1000,
-					 constraints->max_uV / 1000);
+			count += scnprintf(buf + count, len - count,
+					   "%d <--> %d mV ",
+					   constraints->min_uV / 1000,
+					   constraints->max_uV / 1000);
 	}
 
 	if (!constraints->min_uV ||
 	    constraints->min_uV != constraints->max_uV) {
 		ret = _regulator_get_voltage(rdev);
 		if (ret > 0)
-			count += sprintf(buf + count, "at %d mV ", ret / 1000);
+			count += scnprintf(buf + count, len - count,
+					   "at %d mV ", ret / 1000);
 	}
 
 	if (constraints->uV_offset)
-		count += sprintf(buf, "%dmV offset ",
-				 constraints->uV_offset / 1000);
+		count += scnprintf(buf + count, len - count, "%dmV offset ",
+				   constraints->uV_offset / 1000);
 
 	if (constraints->min_uA && constraints->max_uA) {
 		if (constraints->min_uA == constraints->max_uA)
-			count += sprintf(buf + count, "%d mA ",
-					 constraints->min_uA / 1000);
+			count += scnprintf(buf + count, len - count, "%d mA ",
+					   constraints->min_uA / 1000);
 		else
-			count += sprintf(buf + count, "%d <--> %d mA ",
-					 constraints->min_uA / 1000,
-					 constraints->max_uA / 1000);
+			count += scnprintf(buf + count, len - count,
+					   "%d <--> %d mA ",
+					   constraints->min_uA / 1000,
+					   constraints->max_uA / 1000);
 	}
 
 	if (!constraints->min_uA ||
 	    constraints->min_uA != constraints->max_uA) {
 		ret = _regulator_get_current_limit(rdev);
 		if (ret > 0)
-			count += sprintf(buf + count, "at %d mA ", ret / 1000);
+			count += scnprintf(buf + count, len - count,
+					   "at %d mA ", ret / 1000);
 	}
 
 	if (constraints->valid_modes_mask & REGULATOR_MODE_FAST)
-		count += sprintf(buf + count, "fast ");
+		count += scnprintf(buf + count, len - count, "fast ");
 	if (constraints->valid_modes_mask & REGULATOR_MODE_NORMAL)
-		count += sprintf(buf + count, "normal ");
+		count += scnprintf(buf + count, len - count, "normal ");
 	if (constraints->valid_modes_mask & REGULATOR_MODE_IDLE)
-		count += sprintf(buf + count, "idle ");
+		count += scnprintf(buf + count, len - count, "idle ");
 	if (constraints->valid_modes_mask & REGULATOR_MODE_STANDBY)
-		count += sprintf(buf + count, "standby");
+		count += scnprintf(buf + count, len - count, "standby");
 
 	if (!count)
-		sprintf(buf, "no parameters");
+		scnprintf(buf, len, "no parameters");
 
 	rdev_dbg(rdev, "%s\n", buf);
 
-- 
1.7.9.5

Re: [PATCH V2] regulator: core: fix constraints debug output

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 398 bytes --]

On Wed, Jun 03, 2015 at 09:56:29PM +0000, Stefan Wahren wrote:
> The line buffer for constraints debug isn't big enough to hold the output
> in all cases. So fix the possible buffer overflow by the usage of the
> scnprintf().

If we know how much output we might produce then why not extend the
buffer so we don't need to cut it off?  The defensive programming is
good but that seems a better fix.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [PATCH V2] regulator: core: fix constraints debug output

[Stefan Wahren]

> Mark Brown <broonie@kernel.org> hat am 9. Juni 2015 um 20:00 geschrieben:
>
>
> On Wed, Jun 03, 2015 at 09:56:29PM +0000, Stefan Wahren wrote:
> > The line buffer for constraints debug isn't big enough to hold the output
> > in all cases. So fix the possible buffer overflow by the usage of the
> > scnprintf().
>
> If we know how much output we might produce then why not extend the
> buffer so we don't need to cut it off? The defensive programming is
> good but that seems a better fix.
 
I thought the intension was to keep the output in "one" line. If not i suggest
to increase the size to 160 bytes, which is sufficient for all cases.

Re: [PATCH V2] regulator: core: fix constraints debug output

[Mark Brown]

[-- Attachment #1: Type: text/plain, Size: 872 bytes --]

On Tue, Jun 09, 2015 at 08:49:14PM +0200, Stefan Wahren wrote:
> > Mark Brown <broonie@kernel.org> hat am 9. Juni 2015 um 20:00 geschrieben:

> > If we know how much output we might produce then why not extend the
> > buffer so we don't need to cut it off? The defensive programming is
> > good but that seems a better fix.

> I thought the intension was to keep the output in "one" line. If not i suggest
> to increase the size to 160 bytes, which is sufficient for all cases.

No, it was just the first number I thought of - we'll scroll off the end
of an 80 column line anyway due to the prefixes that get added (time,
regulator subsystem name and so on).  The bounds checking seems good but
it seems like a second patch after bumping the buffer which is a much
more focused fix for stable.  I've also just done a separate patch for
the buffer corruption you reported.

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]