s390/cio: Use scnprintf() instead of sprintf()

Use scnprintf() instead of sprintf() for those cases where the destination
is an array and the size of the array is known at compile time.

This prevents theoretical buffer overflows, but also avoids that people
again and again spend time to figure out if the code is actually safe.

Reviewed-by: Jan Polensky <japo@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>

diff --git a/drivers/s390/cio/ccwgroup.c b/drivers/s390/cio/ccwgroup.c
index 2fc2ea4b2e3bc1acfae01ae23b33c0df248f69d8..185c99c5d4cc179633d7262f482a0434eef2447b 100644 (file)
--- a/drivers/s390/cio/ccwgroup.c
+++ b/drivers/s390/cio/ccwgroup.c
@@ -41,7 +41,7 @@ static void __ccwgroup_remove_symlinks(struct ccwgroup_device *gdev)
        char str[16];
 
        for (i = 0; i < gdev->count; i++) {
-               sprintf(str, "cdev%d", i);
+               scnprintf(str, sizeof(str), "cdev%d", i);
                sysfs_remove_link(&gdev->dev.kobj, str);
                sysfs_remove_link(&gdev->cdev[i]->dev.kobj, "group_device");
        }
@@ -249,12 +249,12 @@ static int __ccwgroup_create_symlinks(struct ccwgroup_device *gdev)
                }
        }
        for (i = 0; i < gdev->count; i++) {
-               sprintf(str, "cdev%d", i);
+               scnprintf(str, sizeof(str), "cdev%d", i);
                rc = sysfs_create_link(&gdev->dev.kobj,
                                       &gdev->cdev[i]->dev.kobj, str);
                if (rc) {
                        while (i--) {
-                               sprintf(str, "cdev%d", i);
+                               scnprintf(str, sizeof(str), "cdev%d", i);
                                sysfs_remove_link(&gdev->dev.kobj, str);
                        }
                        for (i = 0; i < gdev->count; i++)

diff --git a/drivers/s390/cio/chp.c b/drivers/s390/cio/chp.c
index caa300160b1756c5d22f53cf07f04cd5d4646c13..c10e2444507ed9a92f283afa9e6529c68595fc7a 100644 (file)
--- a/drivers/s390/cio/chp.c
+++ b/drivers/s390/cio/chp.c
@@ -111,8 +111,9 @@ static int s390_vary_chpid(struct chp_id chpid, int on)
        char dbf_text[15];
        int status;
 
-       sprintf(dbf_text, on?"varyon%x.%02x":"varyoff%x.%02x", chpid.cssid,
-               chpid.id);
+       scnprintf(dbf_text, sizeof(dbf_text),
+                 on ? "varyon%x.%02x" : "varyoff%x.%02x",
+                 chpid.cssid, chpid.id);
        CIO_TRACE_EVENT(2, dbf_text);
 
        status = chp_get_status(chpid);

diff --git a/drivers/s390/cio/chsc.c b/drivers/s390/cio/chsc.c
index 239c92d4ec11e50e49b496496e0ead6957a47c10..edebb0d06ab70a2d411e4677849820c7a54e840a 100644 (file)
--- a/drivers/s390/cio/chsc.c
+++ b/drivers/s390/cio/chsc.c
@@ -253,7 +253,7 @@ void chsc_chp_offline(struct chp_id chpid)
        struct chp_link link;
        char dbf_txt[15];
 
-       sprintf(dbf_txt, "chpr%x.%02x", chpid.cssid, chpid.id);
+       scnprintf(dbf_txt, sizeof(dbf_txt), "chpr%x.%02x", chpid.cssid, chpid.id);
        CIO_TRACE_EVENT(2, dbf_txt);
 
        if (chp_get_status(chpid) <= 0)
@@ -284,11 +284,11 @@ static void s390_process_res_acc(struct chp_link *link)
 {
        char dbf_txt[15];
 
-       sprintf(dbf_txt, "accpr%x.%02x", link->chpid.cssid,
-               link->chpid.id);
+       scnprintf(dbf_txt, sizeof(dbf_txt), "accpr%x.%02x", link->chpid.cssid,
+                 link->chpid.id);
        CIO_TRACE_EVENT( 2, dbf_txt);
        if (link->fla != 0) {
-               sprintf(dbf_txt, "fla%x", link->fla);
+               scnprintf(dbf_txt, sizeof(dbf_txt), "fla%x", link->fla);
                CIO_TRACE_EVENT( 2, dbf_txt);
        }
        /* Wait until previous actions have settled. */
@@ -757,7 +757,7 @@ void chsc_chp_online(struct chp_id chpid)
        struct chp_link link;
        char dbf_txt[15];
 
-       sprintf(dbf_txt, "cadd%x.%02x", chpid.cssid, chpid.id);
+       scnprintf(dbf_txt, sizeof(dbf_txt), "cadd%x.%02x", chpid.cssid, chpid.id);
        CIO_TRACE_EVENT(2, dbf_txt);
 
        if (chp_get_status(chpid) != 0) {

diff --git a/drivers/s390/cio/cio.c b/drivers/s390/cio/cio.c
index 21508e4606d5986d55830e20a6e7896d0d9273f6..6bcc8e58e5f98bddf5cb2c7f591dd45a1293cd98 100644 (file)
--- a/drivers/s390/cio/cio.c
+++ b/drivers/s390/cio/cio.c
@@ -113,7 +113,7 @@ cio_start_handle_notoper(struct subchannel *sch, __u8 lpm)
        if (cio_update_schib(sch))
                return -ENODEV;
 
-       sprintf(dbf_text, "no%s", dev_name(&sch->dev));
+       scnprintf(dbf_text, sizeof(dbf_text), "no%s", dev_name(&sch->dev));
        CIO_TRACE_EVENT(0, dbf_text);
        CIO_HEX_EVENT(0, &sch->schib, sizeof (struct schib));
 

diff --git a/drivers/s390/cio/device_status.c b/drivers/s390/cio/device_status.c
index 0ff8482a7b155ef878e44b5dcd7bd995f86be740..f4096373c8c07f8f51134814a03dbd27819b1d3d 100644 (file)
--- a/drivers/s390/cio/device_status.c
+++ b/drivers/s390/cio/device_status.c
@@ -42,7 +42,7 @@ ccw_device_msg_control_check(struct ccw_device *cdev, struct irb *irb)
                      cdev->private->dev_id.devno, sch->schid.ssid,
                      sch->schid.sch_no,
                      scsw_dstat(&irb->scsw), scsw_cstat(&irb->scsw));
-       sprintf(dbf_text, "chk%x", sch->schid.sch_no);
+       scnprintf(dbf_text, sizeof(dbf_text), "chk%x", sch->schid.sch_no);
        CIO_TRACE_EVENT(0, dbf_text);
        CIO_HEX_EVENT(0, irb, sizeof(struct irb));
 }