Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

ntb/ntb_tool: correct sscanf format for u64 and size_t in tool_peer_mw_trans_write

The sscanf() call in tool_peer_mw_trans_write() uses "%lli:%zi" to parse
user input into 'u64 addr' and 'size_t wsize'. This is incorrect:

- "%lli" expects a signed long long *, but 'addr' is u64 (unsigned).
Input like "0x8000000000000000" is misinterpreted as negative,
leading to corrupted address values.

- "%zi" expects a signed ssize_t *, but 'wsize' is size_t (unsigned).
Input of "-1" is successfully parsed and stored as SIZE_MAX
(e.g., 0xFFFFFFFFFFFFFFFF), which may cause buffer overflows
or infinite loops in subsequent memory operations.

Fix by using format specifiers that match the actual variable types:
- "%llu" for u64 (supports hex/decimal, standard for kernel u64 parsing)
- "%zu" for size_t (standard and safe; rejects negative input)

Signed-off-by: yangqixiao <yangqixiao@inspur.com>
Reviewed-by: Dave Jiang <dave.jiang@intel.com>
Signed-off-by: Jon Mason <jdmason@kudzu.us>

authored by

yangqixiao and committed by
Jon Mason
21fbdc4d 49218116

+1 -1
+1 -1
drivers/ntb/test/ntb_tool.c
··· 936 936 937 937 buf[buf_size] = '\0'; 938 938 939 - n = sscanf(buf, "%lli:%zi", &addr, &wsize); 939 + n = sscanf(buf, "%llu:%zu", &addr, &wsize); 940 940 if (n != 2) 941 941 return -EINVAL; 942 942