mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-29 22:02:02 +00:00
thermal: core: prevent potential string overflow
[ Upstream commitc99626092e
] The dev->id value comes from ida_alloc() so it's a number between zero and INT_MAX. If it's too high then these sprintf()s will overflow. Fixes:203d3d4aa4
("the generic thermal sysfs driver") Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org> Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
bfd4ed4988
commit
3a8f4e58e1
1 changed files with 4 additions and 2 deletions
|
@ -671,7 +671,8 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
|
||||||
if (result)
|
if (result)
|
||||||
goto release_ida;
|
goto release_ida;
|
||||||
|
|
||||||
sprintf(dev->attr_name, "cdev%d_trip_point", dev->id);
|
snprintf(dev->attr_name, sizeof(dev->attr_name), "cdev%d_trip_point",
|
||||||
|
dev->id);
|
||||||
sysfs_attr_init(&dev->attr.attr);
|
sysfs_attr_init(&dev->attr.attr);
|
||||||
dev->attr.attr.name = dev->attr_name;
|
dev->attr.attr.name = dev->attr_name;
|
||||||
dev->attr.attr.mode = 0444;
|
dev->attr.attr.mode = 0444;
|
||||||
|
@ -680,7 +681,8 @@ int thermal_zone_bind_cooling_device(struct thermal_zone_device *tz,
|
||||||
if (result)
|
if (result)
|
||||||
goto remove_symbol_link;
|
goto remove_symbol_link;
|
||||||
|
|
||||||
sprintf(dev->weight_attr_name, "cdev%d_weight", dev->id);
|
snprintf(dev->weight_attr_name, sizeof(dev->weight_attr_name),
|
||||||
|
"cdev%d_weight", dev->id);
|
||||||
sysfs_attr_init(&dev->weight_attr.attr);
|
sysfs_attr_init(&dev->weight_attr.attr);
|
||||||
dev->weight_attr.attr.name = dev->weight_attr_name;
|
dev->weight_attr.attr.name = dev->weight_attr_name;
|
||||||
dev->weight_attr.attr.mode = S_IWUSR | S_IRUGO;
|
dev->weight_attr.attr.mode = S_IWUSR | S_IRUGO;
|
||||||
|
|
Loading…
Reference in a new issue