leandrof/linux
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

s390/zcrypt: Use scnprintf() for avoiding potential buffer overflow

Browse Source 
Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Message-Id: <20200311090915.21059-1-tiwai@suse.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
This commit is contained in:
Takashi Iwai 2020-03-11 10:09:15 +01:00 committed by Vasily Gorbik
parent 52aeda7acc
commit eb3e064b8d
1 changed files with 21 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

40
drivers/s390/crypto/zcrypt_cex4.c
View File

@ -128,16 +128,18 @@ static ssize_t cca_mkvps_show(struct device *dev,
n = snprintf(buf, PAGE_SIZE, "AES NEW: - -\n"); n = snprintf(buf, PAGE_SIZE, "AES NEW: - -\n");
if (ci.cur_mk_state >= '1' && ci.cur_mk_state <= '2') if (ci.cur_mk_state >= '1' && ci.cur_mk_state <= '2')
n += snprintf(buf + n, PAGE_SIZE - n, "AES CUR: %s 0x%016llx\n", n += scnprintf(buf + n, PAGE_SIZE - n,
cao_state[ci.cur_mk_state - '1'], ci.cur_mkvp); "AES CUR: %s 0x%016llx\n",
cao_state[ci.cur_mk_state - '1'], ci.cur_mkvp);
else else
n += snprintf(buf + n, PAGE_SIZE - n, "AES CUR: - -\n"); n += scnprintf(buf + n, PAGE_SIZE - n, "AES CUR: - -\n");
if (ci.old_mk_state >= '1' && ci.old_mk_state <= '2') if (ci.old_mk_state >= '1' && ci.old_mk_state <= '2')
n += snprintf(buf + n, PAGE_SIZE - n, "AES OLD: %s 0x%016llx\n", n += scnprintf(buf + n, PAGE_SIZE - n,
cao_state[ci.old_mk_state - '1'], ci.old_mkvp); "AES OLD: %s 0x%016llx\n",
cao_state[ci.old_mk_state - '1'], ci.old_mkvp);
else else
n += snprintf(buf + n, PAGE_SIZE - n, "AES OLD: - -\n"); n += scnprintf(buf + n, PAGE_SIZE - n, "AES OLD: - -\n");
return n; return n;
} }
@ -251,11 +253,11 @@ static ssize_t ep11_card_op_modes_show(struct device *dev,
if (ci.op_mode & (1 << ep11_op_modes[i].mode_bit)) { if (ci.op_mode & (1 << ep11_op_modes[i].mode_bit)) {
if (n > 0) if (n > 0)
buf[n++] = ' '; buf[n++] = ' ';
n += snprintf(buf + n, PAGE_SIZE - n, n += scnprintf(buf + n, PAGE_SIZE - n,
"%s", ep11_op_modes[i].mode_txt); "%s", ep11_op_modes[i].mode_txt);
} }
} }
n += snprintf(buf + n, PAGE_SIZE - n, "\n"); n += scnprintf(buf + n, PAGE_SIZE - n, "\n");
return n; return n;
} }
@ -305,21 +307,21 @@ static ssize_t ep11_mkvps_show(struct device *dev,
cwk_state[di.cur_wk_state - '0']); cwk_state[di.cur_wk_state - '0']);
bin2hex(buf + n, di.cur_wkvp, sizeof(di.cur_wkvp)); bin2hex(buf + n, di.cur_wkvp, sizeof(di.cur_wkvp));
n += 2 * sizeof(di.cur_wkvp); n += 2 * sizeof(di.cur_wkvp);
n += snprintf(buf + n, PAGE_SIZE - n, "\n"); n += scnprintf(buf + n, PAGE_SIZE - n, "\n");
} else } else
n = snprintf(buf, PAGE_SIZE, "WK CUR: - -\n"); n = snprintf(buf, PAGE_SIZE, "WK CUR: - -\n");
if (di.new_wk_state == '0') { if (di.new_wk_state == '0') {
n += snprintf(buf + n, PAGE_SIZE - n, "WK NEW: %s -\n", n += scnprintf(buf + n, PAGE_SIZE - n, "WK NEW: %s -\n",
nwk_state[di.new_wk_state - '0']); nwk_state[di.new_wk_state - '0']);
} else if (di.new_wk_state >= '1' && di.new_wk_state <= '2') { } else if (di.new_wk_state >= '1' && di.new_wk_state <= '2') {
n += snprintf(buf + n, PAGE_SIZE - n, "WK NEW: %s 0x", n += scnprintf(buf + n, PAGE_SIZE - n, "WK NEW: %s 0x",
nwk_state[di.new_wk_state - '0']); nwk_state[di.new_wk_state - '0']);
bin2hex(buf + n, di.new_wkvp, sizeof(di.new_wkvp)); bin2hex(buf + n, di.new_wkvp, sizeof(di.new_wkvp));
n += 2 * sizeof(di.new_wkvp); n += 2 * sizeof(di.new_wkvp);
n += snprintf(buf + n, PAGE_SIZE - n, "\n"); n += scnprintf(buf + n, PAGE_SIZE - n, "\n");
} else } else
n += snprintf(buf + n, PAGE_SIZE - n, "WK NEW: - -\n"); n += scnprintf(buf + n, PAGE_SIZE - n, "WK NEW: - -\n");
return n; return n;
} }
@ -346,11 +348,11 @@ static ssize_t ep11_queue_op_modes_show(struct device *dev,
if (di.op_mode & (1 << ep11_op_modes[i].mode_bit)) { if (di.op_mode & (1 << ep11_op_modes[i].mode_bit)) {
if (n > 0) if (n > 0)
buf[n++] = ' '; buf[n++] = ' ';
n += snprintf(buf + n, PAGE_SIZE - n, n += scnprintf(buf + n, PAGE_SIZE - n,
"%s", ep11_op_modes[i].mode_txt); "%s", ep11_op_modes[i].mode_txt);
} }
} }
n += snprintf(buf + n, PAGE_SIZE - n, "\n"); n += scnprintf(buf + n, PAGE_SIZE - n, "\n");
return n; return n;
} }