Skip to content

Commit

Permalink
drm/i915/gvt: Use snprintf() to prevent possible buffer overflow.
Browse files Browse the repository at this point in the history
For printing the intel_vgpu->id, a buffer with fixed length is allocated
on the stack. But if vgpu->id is greater than 6 characters, the buffer
overflow will happen. Even the string of the amount of max vgpu is less
that the length buffer right now, it's better to replace sprintf() with
snprintf().

v2:
- Increase the size of the buffer. (Colin Xu)

This patch fixed the critical issue torvalds#673 reported by klocwork.

Signed-off-by: Aleksei Gimbitskii <[email protected]>
Cc: Zhenyu Wang <[email protected]>
Cc: Zhi Wang <[email protected]>
Cc: Colin Xu <[email protected]>
Reviewed-by: Colin Xu <[email protected]>
Signed-off-by: Zhenyu Wang <[email protected]>
  • Loading branch information
Aleksei Gimbitskii authored and zhenyw committed Apr 25, 2019
1 parent d942024 commit 4feeea1
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions drivers/gpu/drm/i915/gvt/debugfs.c
Original file line number Diff line number Diff line change
Expand Up @@ -196,9 +196,9 @@ DEFINE_SIMPLE_ATTRIBUTE(vgpu_scan_nonprivbb_fops,
int intel_gvt_debugfs_add_vgpu(struct intel_vgpu *vgpu)
{
struct dentry *ent;
char name[10] = "";
char name[16] = "";

sprintf(name, "vgpu%d", vgpu->id);
snprintf(name, 16, "vgpu%d", vgpu->id);
vgpu->debugfs = debugfs_create_dir(name, vgpu->gvt->debugfs_root);
if (!vgpu->debugfs)
return -ENOMEM;
Expand Down

0 comments on commit 4feeea1

Please sign in to comment.