| From cb8b86e4c35ce4d05e2a1ae5ae5ae2aecf7a4b75 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 11 May 2021 10:19:26 +0300 |
| Subject: rtc: fix snprintf() checking in is_rtc_hctosys() |
| |
| From: Dan Carpenter <dan.carpenter@oracle.com> |
| |
| [ Upstream commit 54b909436ede47e0ee07f1765da27ec2efa41e84 ] |
| |
| The scnprintf() function silently truncates the printf() and returns |
| the number bytes that it was able to copy (not counting the NUL |
| terminator). Thus, the highest value it can return here is |
| "NAME_SIZE - 1" and the overflow check is dead code. Fix this by |
| using the snprintf() function which returns the number of bytes that |
| would have been copied if there was enough space and changing the |
| condition from "> NAME_SIZE" to ">= NAME_SIZE". |
| |
| Fixes: 92589c986b33 ("rtc-proc: permit the /proc/driver/rtc device to use other devices") |
| Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> |
| Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com> |
| Link: https://lore.kernel.org/r/YJov/pcGmhLi2pEl@mwanda |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| drivers/rtc/proc.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| diff --git a/drivers/rtc/proc.c b/drivers/rtc/proc.c |
| index 73344598fc1b..cbcdbb19d848 100644 |
| --- a/drivers/rtc/proc.c |
| +++ b/drivers/rtc/proc.c |
| @@ -23,8 +23,8 @@ static bool is_rtc_hctosys(struct rtc_device *rtc) |
| int size; |
| char name[NAME_SIZE]; |
| |
| - size = scnprintf(name, NAME_SIZE, "rtc%d", rtc->id); |
| - if (size > NAME_SIZE) |
| + size = snprintf(name, NAME_SIZE, "rtc%d", rtc->id); |
| + if (size >= NAME_SIZE) |
| return false; |
| |
| return !strncmp(name, CONFIG_RTC_HCTOSYS_DEVICE, NAME_SIZE); |
| -- |
| 2.30.2 |
| |