[V2,3/6] drm/i915/gvt: Use snprintf() to prevent possible buffer overflow.

Submitted by Aleksei Gimbitskii on April 11, 2019, 10:46 a.m.

Details

Message ID 20190411104631.7627-4-aleksei.gimbitskii@intel.com
State New
Headers show
Series "Fix issues reported by klocwork" ( rev: 1 ) in Intel GVT devel

Not browsing as part of any series.

Commit Message

Aleksei Gimbitskii April 11, 2019, 10:46 a.m.
For printing the intel_vgpu->id, a buffer with fixed length is allocated
on the stack. But if vgpu->id is greater than 6 characters, the buffer
overflow will happen. Even the string of the amount of max vgpu is less
that the length buffer right now, it's better to replace sprintf() with
snprintf().

v2:
- Increase the size of the buffer. (Colin Xu)

This patch fixed the critical issue #673 reported by klocwork.

Signed-off-by: Aleksei Gimbitskii <aleksei.gimbitskii@intel.com>
Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
Cc: Zhi Wang <zhi.a.wang@intel.com>
Cc: Colin Xu <colin.xu@intel.com>
---
 drivers/gpu/drm/i915/gvt/debugfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Patch hide | download patch | download mbox

diff --git a/drivers/gpu/drm/i915/gvt/debugfs.c b/drivers/gpu/drm/i915/gvt/debugfs.c
index 2ec89bcb59f1..8a9606f91e68 100644
--- a/drivers/gpu/drm/i915/gvt/debugfs.c
+++ b/drivers/gpu/drm/i915/gvt/debugfs.c
@@ -196,9 +196,9 @@  DEFINE_SIMPLE_ATTRIBUTE(vgpu_scan_nonprivbb_fops,
 int intel_gvt_debugfs_add_vgpu(struct intel_vgpu *vgpu)
 {
 	struct dentry *ent;
-	char name[10] = "";
+	char name[16] = "";
 
-	sprintf(name, "vgpu%d", vgpu->id);
+	snprintf(name, 16, "vgpu%d", vgpu->id);
 	vgpu->debugfs = debugfs_create_dir(name, vgpu->gvt->debugfs_root);
 	if (!vgpu->debugfs)
 		return -ENOMEM;

Comments

On 2019-04-11 18:46, Aleksei Gimbitskii wrote:
> For printing the intel_vgpu->id, a buffer with fixed length is allocated
> on the stack. But if vgpu->id is greater than 6 characters, the buffer
> overflow will happen. Even the string of the amount of max vgpu is less
> that the length buffer right now, it's better to replace sprintf() with
> snprintf().
>
> v2:
> - Increase the size of the buffer. (Colin Xu)
>
> This patch fixed the critical issue #673 reported by klocwork.
>
> Signed-off-by: Aleksei Gimbitskii <aleksei.gimbitskii@intel.com>
> Cc: Zhenyu Wang <zhenyuw@linux.intel.com>
> Cc: Zhi Wang <zhi.a.wang@intel.com>
> Cc: Colin Xu <colin.xu@intel.com>
> ---
Reviewed-by: Colin Xu <colin.xu@intel.com>

Thanks for the fix!
>   drivers/gpu/drm/i915/gvt/debugfs.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/gpu/drm/i915/gvt/debugfs.c b/drivers/gpu/drm/i915/gvt/debugfs.c
> index 2ec89bcb59f1..8a9606f91e68 100644
> --- a/drivers/gpu/drm/i915/gvt/debugfs.c
> +++ b/drivers/gpu/drm/i915/gvt/debugfs.c
> @@ -196,9 +196,9 @@ DEFINE_SIMPLE_ATTRIBUTE(vgpu_scan_nonprivbb_fops,
>   int intel_gvt_debugfs_add_vgpu(struct intel_vgpu *vgpu)
>   {
>   	struct dentry *ent;
> -	char name[10] = "";
> +	char name[16] = "";
>   
> -	sprintf(name, "vgpu%d", vgpu->id);
> +	snprintf(name, 16, "vgpu%d", vgpu->id);
>   	vgpu->debugfs = debugfs_create_dir(name, vgpu->gvt->debugfs_root);
>   	if (!vgpu->debugfs)
>   		return -ENOMEM;