cpu: hotplug: Bound hotplug states sysfs output

states_show() adds CPU hotplug state names into a single sysfs buffer
using sprintf(). With enough registered states, this can write past the
end of the PAGE_SIZE buffer.

Use sysfs_emit_at() so output is bounded.

Fixes: 98f8cdce1db5 ("cpu/hotplug: Add sysfs state interface")
Signed-off-by: Bradley Morgan <include@grrlz.net>
Signed-off-by: Thomas Gleixner <tglx@kernel.org>
Cc: stable@vger.kernel.org
Link: https://patch.msgid.link/20260619163719.12103-2-include@grrlz.net

diff --git a/kernel/cpu.c b/kernel/cpu.c
index 3ed24c711e3f856ed42adebdcaa9c7715238c062..77fdb2013ab8f8ea768acd22deed1fd44b8ecad7 100644 (file)
--- a/kernel/cpu.c
+++ b/kernel/cpu.c
@@ -2865,21 +2865,17 @@ static const struct attribute_group cpuhp_cpu_attr_group = {
        .name = "hotplug",
 };
 
-static ssize_t states_show(struct device *dev,
-                                struct device_attribute *attr, char *buf)
+static ssize_t states_show(struct device *dev, struct device_attribute *attr, char *buf)
 {
-       ssize_t cur, res = 0;
+       ssize_t res = 0;
        int i;
 
        mutex_lock(&cpuhp_state_mutex);
        for (i = CPUHP_OFFLINE; i <= CPUHP_ONLINE; i++) {
                struct cpuhp_step *sp = cpuhp_get_step(i);
 
-               if (sp->name) {
-                       cur = sprintf(buf, "%3d: %s\n", i, sp->name);
-                       buf += cur;
-                       res += cur;
-               }
+               if (sp->name)
+                       res += sysfs_emit_at(buf, res, "%3d: %s\n", i, sp->name);
        }
        mutex_unlock(&cpuhp_state_mutex);
        return res;