@@ -209,16 +209,28 @@
return -EINVAL;
}
+ /*
+ * Each entry occupies two u32s in buf_page. Never walk past the
+ * page, and never sprintf past the PAGE_SIZE sysfs buffer.
+ */
cnt = retbuf[0];
+ if (cnt > (PAGE_SIZE / sizeof(u32)) / 2)
+ cnt = (PAGE_SIZE / sizeof(u32)) / 2;
+
for (i = 0; i < cnt; i++) {
cpu = drc_index_to_cpu(buf_page[2*i+1]);
if ((cpu_online(cpu) && !activate) ||
- (!cpu_online(cpu) && activate))
+ (!cpu_online(cpu) && activate)) {
+ if (s - page >= PAGE_SIZE - 16)
+ break;
s += sprintf(s, "%d,", cpu);
+ }
}
if (s > page) { /* Something to show */
s--; /* Suppress last comma */
- s += sprintf(s, "\n");
+ /* sprintf needs room for '\n' and trailing NUL. */
+ if (s - page < PAGE_SIZE - 1)
+ s += sprintf(s, "\n");
}
free_page((unsigned long) buf_page);
The H_BEST_ENERGY sysfs path takes cnt from the hypercall return buffer and walks buf_page[2*i+1] without checking that cnt fits in the single page allocated for the hcall, and sprintf()s into the PAGE_SIZE sysfs buffer without remaining-space checks. Clamp cnt to the number of u32 pairs that fit in the page, and stop formatting before overflowing the sysfs page. Signed-off-by: Xixin Liu <liuxixin@kylinos.cn> --- 1 file changed, 14 insertions(+), 2 deletions(-)