]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
cpufreq: stats: Fix buffer overflow detection in trans_stats()
authorChristian Marangi <ansuelsmth@gmail.com>
Tue, 24 Oct 2023 18:30:14 +0000 (20:30 +0200)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 28 Nov 2023 17:07:16 +0000 (17:07 +0000)
commite785584e0a0bdb105a440cd94da3fe27ee4ff955
tree9ff60ab1924d14f2ae807d607e5d949d045bb511
parentc2d14682b36d3e77f278fbccde8f2b8007dcf24e
cpufreq: stats: Fix buffer overflow detection in trans_stats()

[ Upstream commit ea167a7fc2426f7685c3735e104921c1a20a6d3f ]

Commit 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential
buffer overflow") switched from snprintf to the more secure scnprintf
but never updated the exit condition for PAGE_SIZE.

As the commit say and as scnprintf document, what scnprintf returns what
is actually written not counting the '\0' end char. This results in the
case of len exceeding the size, len set to PAGE_SIZE - 1, as it can be
written at max PAGE_SIZE - 1 (as '\0' is not counted)

Because of len is never set to PAGE_SIZE, the function never break early,
never prints the warning and never return -EFBIG.

Fix this by changing the condition to PAGE_SIZE - 1 to correctly trigger
the error.

Cc: 5.10+ <stable@vger.kernel.org> # 5.10+
Fixes: 3c0897c180c6 ("cpufreq: Use scnprintf() for avoiding potential buffer overflow")
Signed-off-by: Christian Marangi <ansuelsmth@gmail.com>
[ rjw: Subject and changelog edits ]
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/cpufreq/cpufreq_stats.c