From: Thorsten Blum <thorsten.blum@linux.dev>
Date: Sun, 7 Jun 2026 02:17:52 +0000 (-0600)
Subject: riscv: ptdump: Replace unbounded sprintf() in dump_prot()
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=1a9e47c2c38ad2af1916cdd4a0119e87ecb5baae;p=thirdparty%2Flinux.git

riscv: ptdump: Replace unbounded sprintf() in dump_prot()

Replace the unbounded sprintf("%s", ...) with the faster and safer
strscpy(). Replace all other sprintf() calls with the safer snprintf().

Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
Link: https://patch.msgid.link/20260127110543.436242-1-thorsten.blum@linux.dev
Signed-off-by: Paul Walmsley <pjw@kernel.org>
---

diff --git a/arch/riscv/mm/ptdump.c b/arch/riscv/mm/ptdump.c
index 34299c2b231f..f4b4a9fcbbd8 100644
--- a/arch/riscv/mm/ptdump.c
+++ b/arch/riscv/mm/ptdump.c
@@ -7,6 +7,7 @@
 #include <linux/init.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/string.h>
 #include <linux/ptdump.h>
 
 #include <linux/pgtable.h>
@@ -213,21 +214,21 @@ static void dump_prot(struct pg_state *st)
 		val = st->current_prot & pte_bits[i].mask;
 		if (val) {
 			if (pte_bits[i].mask == _PAGE_SOFT)
-				sprintf(s, pte_bits[i].set, val >> 8);
+				snprintf(s, sizeof(s), pte_bits[i].set, val >> 8);
 #ifdef CONFIG_64BIT
 			else if (pte_bits[i].mask == _PAGE_MTMASK_SVPBMT) {
 				if (val == _PAGE_NOCACHE_SVPBMT)
-					sprintf(s, pte_bits[i].set, "NC");
+					snprintf(s, sizeof(s), pte_bits[i].set, "NC");
 				else if (val == _PAGE_IO_SVPBMT)
-					sprintf(s, pte_bits[i].set, "IO");
+					snprintf(s, sizeof(s), pte_bits[i].set, "IO");
 				else
-					sprintf(s, pte_bits[i].set, "??");
+					snprintf(s, sizeof(s), pte_bits[i].set, "??");
 			}
 #endif
 			else
-				sprintf(s, "%s", pte_bits[i].set);
+				strscpy(s, pte_bits[i].set);
 		} else {
-			sprintf(s, "%s", pte_bits[i].clear);
+			strscpy(s, pte_bits[i].clear);
 		}
 
 		pt_dump_seq_printf(st->seq, " %s", s);