]> git.ipfire.org Git - thirdparty/kernel/linux.git/commit
ntb/ntb_tool: correct sscanf format for u64 and size_t in tool_peer_mw_trans_write
authoryangqixiao <yangqixiao@inspur.com>
Tue, 30 Dec 2025 12:46:56 +0000 (20:46 +0800)
committerJon Mason <jdmason@kudzu.us>
Fri, 20 Feb 2026 22:31:55 +0000 (17:31 -0500)
commit21fbdc4d0b1e7f9cabacc3587d07c62e01c7b5e8
tree7a36b66242c91f820ce295f5f1d5b544a788e5b6
parent4921811678e93a83cbfebc14814a165ae794bf1d
ntb/ntb_tool: correct sscanf format for u64 and size_t in tool_peer_mw_trans_write

The sscanf() call in tool_peer_mw_trans_write() uses "%lli:%zi" to parse
user input into 'u64 addr' and 'size_t wsize'. This is incorrect:

 - "%lli" expects a signed long long *, but 'addr' is u64 (unsigned).
   Input like "0x8000000000000000" is misinterpreted as negative,
   leading to corrupted address values.

 - "%zi" expects a signed ssize_t *, but 'wsize' is size_t (unsigned).
   Input of "-1" is successfully parsed and stored as SIZE_MAX
   (e.g., 0xFFFFFFFFFFFFFFFF), which may cause buffer overflows
   or infinite loops in subsequent memory operations.

Fix by using format specifiers that match the actual variable types:
 - "%llu" for u64 (supports hex/decimal, standard for kernel u64 parsing)
 - "%zu" for size_t (standard and safe; rejects negative input)

Signed-off-by: yangqixiao <yangqixiao@inspur.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>
drivers/ntb/test/ntb_tool.c