Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'hwmon-for-linus-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging
Pull hwmon fix from Guenter Roeck:
"Avoid buffer overruns in applesmc driver"
* tag 'hwmon-for-linus-v4.13-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
hwmon: (applesmc) Avoid buffer overruns
+9
-4
+9
-4
drivers/hwmon/applesmc.c
+9
-4
drivers/hwmon/applesmc.c
···
566
566
if (ret)
567
567
return ret;
568
568
s->fan_count = tmp[0];
569
+
if (s->fan_count > 10)
570
+
s->fan_count = 10;
569
571
570
572
ret = applesmc_get_lower_bound(&s->temp_begin, "T");
571
573
if (ret)
···
813
811
char newkey[5];
814
812
u8 buffer[2];
815
813
816
-
sprintf(newkey, fan_speed_fmt[to_option(attr)], to_index(attr));
814
+
scnprintf(newkey, sizeof(newkey), fan_speed_fmt[to_option(attr)],
815
+
to_index(attr));
817
816
818
817
ret = applesmc_read_key(newkey, buffer, 2);
819
818
speed = ((buffer[0] << 8 | buffer[1]) >> 2);
···
837
834
if (kstrtoul(sysfsbuf, 10, &speed) < 0 || speed >= 0x4000)
838
835
return -EINVAL; /* Bigger than a 14-bit value */
839
836
840
-
sprintf(newkey, fan_speed_fmt[to_option(attr)], to_index(attr));
837
+
scnprintf(newkey, sizeof(newkey), fan_speed_fmt[to_option(attr)],
838
+
to_index(attr));
841
839
842
840
buffer[0] = (speed >> 6) & 0xff;
843
841
buffer[1] = (speed << 2) & 0xff;
···
907
903
char newkey[5];
908
904
u8 buffer[17];
909
905
910
-
sprintf(newkey, FAN_ID_FMT, to_index(attr));
906
+
scnprintf(newkey, sizeof(newkey), FAN_ID_FMT, to_index(attr));
911
907
912
908
ret = applesmc_read_key(newkey, buffer, 16);
913
909
buffer[16] = 0;
···
1120
1116
}
1121
1117
for (i = 0; i < num; i++) {
1122
1118
node = &grp->nodes[i];
1123
-
sprintf(node->name, grp->format, i + 1);
1119
+
scnprintf(node->name, sizeof(node->name), grp->format,
1120
+
i + 1);
1124
1121
node->sda.index = (grp->option << 16) | (i & 0xffff);
1125
1122
node->sda.dev_attr.show = grp->show;
1126
1123
node->sda.dev_attr.store = grp->store;