From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2BAAC1FC8 for ; Sat, 18 Jul 2026 04:42:45 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784349767; cv=none; b=A2eeGEcKk9597LIPo+hxGDmLWBghQEr9eu3q8U64VlT+0/iiYHNhgXpjcUH1S2ZRsMAD4vZm/SKO+kovuJytVkTnJRfNBFtWrzANttosF/opRKwuj+tirMuPD7xA3/2ezO1FDwYiIJa8BNrIE2WmgRYh/A5y3y21vmK+fpiC5uQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784349767; c=relaxed/simple; bh=cKYqxL3jzR8vFba6Cp693tIu/kqmUejaU+VCmSdFwrY=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=SjcsjbXZ/sq+ehu5tQ/oSMIZLDy/lwTATb7LK5KUkhS3nov0N2OiO+Ee61CWsvsjpNVLtYqZ2SXrELMoziA9dXT2XFnS2O52l5peojLEPMx1Pe/44gSgH69B6sFnXBzuEu9p0691Ys1p7TSw+ADvMdF1Q3ahLGjzeM0uYqeEui0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=b3J/lRDX; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="b3J/lRDX" Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2cc7ef7ec27so95999025ad.1 for ; Fri, 17 Jul 2026 21:42:45 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1784349765; x=1784954565; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=7yaLxWejf29cL56OietuZ2+Mlao1Prg9ji1ZVxHMa+U=; b=b3J/lRDXKcBcnX+kHMRTXCd28y6WXl0E3qPmra82ik3wDUS4yxahcv1spmvgItiEE7 k23hPb81FzWonk0vU3khVtpLYCldBNYmV3LSIiRzhNJ9WkI2PKZkXvLfbkzvdYpXdVAS PYH62Gr8TocMglqeql3fzeCcIFmckhsw24jH/P+LwlfSABakmf5K4J7O41jyJ/csQ6i5 xIf27D0Tj4gRXWtUMyUIT18/yJS+cO+R7f1gYW3fMKxnbQc8tVzAyv8jGTctonZuL9+5 SUrdfGv2cBZwBBgdpADJsqkWNbJGfYA/7O+jGU1Qq+b3VXUyADYJQA6duo4tzlliavLF JOlw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1784349765; x=1784954565; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=7yaLxWejf29cL56OietuZ2+Mlao1Prg9ji1ZVxHMa+U=; b=rxy51wPlbbWW7Xd98i5hhj6lAGM5iJ5vpAX51FhBsad1d/LFTAldps6a99nBZHJTtH tu6h1n+d3i3SelzjmDsDhsxV0nvATsFEqQgSbSlLOh1P0GxD/rLEeIOejqR8o8J9nGEN um2+0xlKGD/xPzcsU+Vl9cazyBtvxLfvVx1H/MEAiye+lxonaKz3lfw6n99yfUeDVfuM aSC3pMBi9M6RuNZCxNIlckIQKgmhaqVIULf+kcFoLUWqiTL3sRkrnCd8d2Jnipxq0A0w jBTsOTWtT9+YPZYmVSuCtUF7qJL7qpbzePIc3Zmkwh/DBlWMxaMCEPrTjnyKLyl87u3a L7UQ== X-Forwarded-Encrypted: i=1; AHgh+Ro+S9kocgaikiQcIYtHqr1oNGV75B1NQBCOfrulIN1xjLasD355EKizbcxHWqxhDJJH38sn34RohuwhPYo=@vger.kernel.org X-Gm-Message-State: AOJu0YxXDgYB/FKquJagwcqD7V19Betv6Kz3+0KpTS5lsctJLrQrNAgg ZqT0qajFCnsWC7RO/WxRSuITnqkVSikxQ66Bt/FhmLTkXgm0a/p5Ks5c X-Gm-Gg: AfdE7cmPQ6vdtfq+KGZS/d0ronHvKUBFJdguBWS8tlc7srhMyxr4qqh1HG7W1iKvVcf J4VFByZ5tEv73CokIKuEJBnExNF8a0anqiF4CNvV3ps9Eh3b4l1zhMff4Xnr5HgJ0y656AkZWzk LPKtrp7KCYfp2qwDFHLCo4JcUbbnnXLr0CiFycGw0vQVIhrgY+5LR6lZIcXR+C/pSoocR0Nr+nh KfnkBfG4d6vjut8VoXodYwK/i7Fqu1HPe+TxVIfAZiHkfK4R0XctIi/Vl1AkHOAmhKEfi485sId R6hyHS/w8Iv2hgxXK//PtgxUspmSX5j1y8sVSGN4K14kBi1OCPnVSlAST7REuQUcn4Je7urfSHw 5MajtifLj1XwqdDjnyGm9lq9dvIUVGhQDo9zsLqANlqAX3KbXUT0v/+S8ScbkykljLlZaIoE0Uq GA8Q== X-Received: by 2002:a17:903:b08:b0:2c6:90ec:f601 with SMTP id d9443c01a7336-2cf34835859mr63305995ad.8.1784349765450; Fri, 17 Jul 2026 21:42:45 -0700 (PDT) Received: from kdev.. ([108.180.130.139]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2cf344bd3aesm21644465ad.26.2026.07.17.21.42.44 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 17 Jul 2026 21:42:44 -0700 (PDT) From: Babanpreet Singh To: Jonathan Cameron Cc: =?UTF-8?q?Nuno=20S=C3=A1?= , Michael Hennerich , David Lechner , Andy Shevchenko , Angelo Dureghello , linux@analog.com, linux-iio@vger.kernel.org, linux-kernel@vger.kernel.org, Babanpreet Singh , Andy Shevchenko Subject: [PATCH v2] iio: dac: ad3552r-hs: use sysfs_emit_at() in data source avail show Date: Sat, 18 Jul 2026 04:42:44 +0000 Message-ID: <20260718044244.7-1-bbnpreetsingh@gmail.com> X-Mailer: git-send-email 2.47.3 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit ad3552r_hs_show_data_source_avail() formats the available data source names into a 128-byte stack buffer, but bounds each scnprintf() with PAGE_SIZE instead of the buffer size, so the bound does not protect the destination at all. This cannot overflow today - dbgfs_attr_source[] has two entries, "normal" and "ramp-16bit", 18 bytes formatted - but the bound stops protecting the stack the day the table grows. Found by smatch: drivers/iio/dac/ad3552r-hs.c:593 ad3552r_hs_show_data_source_avail() error: scnprintf() 'buf[len]' too small (128 vs 4096) Instead of shrinking the scnprintf() bound to the buffer size, switch to sysfs_emit_at(), which enforces the PAGE_SIZE bound internally and is the preferred helper for formatting attribute-style output; the IIO core formats its own avail lists the same way in iio_format_list(). sysfs_emit_at() refuses buffers that are not page-aligned, so replace the stack buffer with a kzalloc()'d page - power-of-two kmalloc() allocations are naturally aligned, see Documentation/core-api/memory-allocation.rst. Fixes: b1c5d68ea66e ("iio: dac: ad3552r-hs: add support for internal ramp") Suggested-by: Andy Shevchenko Assisted-by: claude-sonnet-5 Signed-off-by: Babanpreet Singh --- v2: - Switch to sysfs_emit_at() with a kzalloc()'d page instead of bounding scnprintf() with sizeof(buf), as suggested by Andy Shevchenko. sysfs_emit_at() requires a page-aligned buffer, so the 128-byte stack buffer cannot stay; add the cleanup.h, slab.h and sysfs.h includes the new code needs. - Retitled; v1 was "iio: dac: ad3552r-hs: fix scnprintf() buffer bound in data source show". v1: https://lore.kernel.org/r/20260717040024.7-1-bbnpreetsingh@gmail.com drivers/iio/dac/ad3552r-hs.c | 16 ++++++++++------ 1 file changed, 10 insertions(+), 6 deletions(-) diff --git a/drivers/iio/dac/ad3552r-hs.c b/drivers/iio/dac/ad3552r-hs.c index 02a124ac4855..c561fed2ef1a 100644 --- a/drivers/iio/dac/ad3552r-hs.c +++ b/drivers/iio/dac/ad3552r-hs.c @@ -7,6 +7,7 @@ */ #include +#include #include #include #include @@ -14,6 +15,8 @@ #include #include #include +#include +#include #include #include "ad3552r.h" @@ -585,14 +588,15 @@ static ssize_t ad3552r_hs_show_data_source_avail(struct file *f, char __user *userbuf, size_t count, loff_t *ppos) { - ssize_t len = 0; - char buf[128]; + char *buf __free(kfree) = kzalloc(PAGE_SIZE, GFP_KERNEL); + int len = 0; int i; - for (i = 0; i < ARRAY_SIZE(dbgfs_attr_source); i++) { - len += scnprintf(buf + len, PAGE_SIZE - len, "%s ", - dbgfs_attr_source[i]); - } + if (!buf) + return -ENOMEM; + + for (i = 0; i < ARRAY_SIZE(dbgfs_attr_source); i++) + len += sysfs_emit_at(buf, len, "%s ", dbgfs_attr_source[i]); buf[len - 1] = '\n'; return simple_read_from_buffer(userbuf, count, ppos, buf, len); base-commit: fce2dfa773ced15f27dd27cd0b482a7473cdcf2a -- 2.43.0