USB: mon: Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Link: https://lore.kernel.org/r/20200311093003.24604-1-tiwai@suse.de
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/usb/mon/mon_text.c b/drivers/usb/mon/mon_text.c
index bc5ecd5..39cb141 100644 (file)
--- a/drivers/usb/mon/mon_text.c
+++ b/drivers/usb/mon/mon_text.c
@@ -414,7 +414,7 @@ static ssize_t mon_text_read_t(struct file *file, char __user *buf,
 
                mon_text_read_head_t(rp, &ptr, ep);
                mon_text_read_statset(rp, &ptr, ep);
-               ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+               ptr.cnt += scnprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
                    " %d", ep->length);
                mon_text_read_data(rp, &ptr, ep);
 
@@ -462,7 +462,7 @@ static ssize_t mon_text_read_u(struct file *file, char __user *buf,
                } else {
                        mon_text_read_statset(rp, &ptr, ep);
                }
-               ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+               ptr.cnt += scnprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
                    " %d", ep->length);
                mon_text_read_data(rp, &ptr, ep);
 
@@ -520,7 +520,7 @@ static void mon_text_read_head_t(struct mon_reader_text *rp,
        case USB_ENDPOINT_XFER_CONTROL: utype = 'C'; break;
        default: /* PIPE_BULK */  utype = 'B';
        }
-       p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+       p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
            "%lx %u %c %c%c:%03u:%02u",
            ep->id, ep->tstamp, ep->type,
            utype, udir, ep->devnum, ep->epnum);
@@ -538,7 +538,7 @@ static void mon_text_read_head_u(struct mon_reader_text *rp,
        case USB_ENDPOINT_XFER_CONTROL: utype = 'C'; break;
        default: /* PIPE_BULK */  utype = 'B';
        }
-       p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+       p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
            "%lx %u %c %c%c:%d:%03u:%u",
            ep->id, ep->tstamp, ep->type,
            utype, udir, ep->busnum, ep->devnum, ep->epnum);
@@ -549,7 +549,7 @@ static void mon_text_read_statset(struct mon_reader_text *rp,
 {
 
        if (ep->setup_flag == 0) {   /* Setup packet is present and captured */
-               p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+               p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
                    " s %02x %02x %04x %04x %04x",
                    ep->setup[0],
                    ep->setup[1],
@@ -557,10 +557,10 @@ static void mon_text_read_statset(struct mon_reader_text *rp,
                    (ep->setup[5] << 8) | ep->setup[4],
                    (ep->setup[7] << 8) | ep->setup[6]);
        } else if (ep->setup_flag != '-') { /* Unable to capture setup packet */
-               p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+               p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
                    " %c __ __ ____ ____ ____", ep->setup_flag);
        } else {                     /* No setup for this kind of URB */
-               p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+               p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
                    " %d", ep->status);
        }
 }
@@ -568,7 +568,7 @@ static void mon_text_read_statset(struct mon_reader_text *rp,
 static void mon_text_read_intstat(struct mon_reader_text *rp,
        struct mon_text_ptr *p, const struct mon_event_text *ep)
 {
-       p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+       p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
            " %d:%d", ep->status, ep->interval);
 }
 
@@ -576,10 +576,10 @@ static void mon_text_read_isostat(struct mon_reader_text *rp,
        struct mon_text_ptr *p, const struct mon_event_text *ep)
 {
        if (ep->type == 'S') {
-               p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+               p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
                    " %d:%d:%d", ep->status, ep->interval, ep->start_frame);
        } else {
-               p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+               p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
                    " %d:%d:%d:%d",
                    ep->status, ep->interval, ep->start_frame, ep->error_count);
        }
@@ -592,7 +592,7 @@ static void mon_text_read_isodesc(struct mon_reader_text *rp,
        int i;
        const struct mon_iso_desc *dp;
 
-       p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+       p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
            " %d", ep->numdesc);
        ndesc = ep->numdesc;
        if (ndesc > ISODESC_MAX)
@@ -601,7 +601,7 @@ static void mon_text_read_isodesc(struct mon_reader_text *rp,
                ndesc = 0;
        dp = ep->isodesc;
        for (i = 0; i < ndesc; i++) {
-               p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+               p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
                    " %d:%u:%u", dp->status, dp->offset, dp->length);
                dp++;
        }
@@ -614,28 +614,28 @@ static void mon_text_read_data(struct mon_reader_text *rp,
 
        if ((data_len = ep->length) > 0) {
                if (ep->data_flag == 0) {
-                       p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+                       p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
                            " =");
                        if (data_len >= DATA_MAX)
                                data_len = DATA_MAX;
                        for (i = 0; i < data_len; i++) {
                                if (i % 4 == 0) {
-                                       p->cnt += snprintf(p->pbuf + p->cnt,
+                                       p->cnt += scnprintf(p->pbuf + p->cnt,
                                            p->limit - p->cnt,
                                            " ");
                                }
-                               p->cnt += snprintf(p->pbuf + p->cnt,
+                               p->cnt += scnprintf(p->pbuf + p->cnt,
                                    p->limit - p->cnt,
                                    "%02x", ep->data[i]);
                        }
-                       p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+                       p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
                            "\n");
                } else {
-                       p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt,
+                       p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt,
                            " %c\n", ep->data_flag);
                }
        } else {
-               p->cnt += snprintf(p->pbuf + p->cnt, p->limit - p->cnt, "\n");
+               p->cnt += scnprintf(p->pbuf + p->cnt, p->limit - p->cnt, "\n");
        }
 }