Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 3b9b9536 authored by Nathan Sullivan's avatar Nathan Sullivan Committed by Jacek Anaszewski
Browse files

leds: do not overflow sysfs buffer in led_trigger_show 



Per the documentation, use scnprintf instead of sprintf to ensure there
is never more than PAGE_SIZE bytes of trigger names put into the
buffer.

Signed-off-by: default avatarNathan Sullivan <nathan.sullivan@ni.com>
Signed-off-by: default avatarZach Brown <zach.brown@ni.com>
Signed-off-by: default avatarJacek Anaszewski <j.anaszewski@samsung.com>
parent 50237863

drivers/leds/led-triggers.c

+7 −5
Original line number Diff line number Diff line
@@ -81,21 +81,23 @@ ssize_t led_trigger_show(struct device *dev, struct device_attribute *attr, 
	down_read(&led_cdev->trigger_lock);



	if (!led_cdev->trigger)

		len += sprintf(buf+len, "[none] ");

		len += scnprintf(buf+len, PAGE_SIZE - len, "[none] ");

	else

		len += sprintf(buf+len, "none ");

		len += scnprintf(buf+len, PAGE_SIZE - len, "none ");



	list_for_each_entry(trig, &trigger_list, next_trig) {

		if (led_cdev->trigger && !strcmp(led_cdev->trigger->name,

							trig->name))

			len += sprintf(buf+len, "[%s] ", trig->name);

			len += scnprintf(buf+len, PAGE_SIZE - len, "[%s] ",

					 trig->name);

		else

			len += sprintf(buf+len, "%s ", trig->name);

			len += scnprintf(buf+len, PAGE_SIZE - len, "%s ",

					 trig->name);

	}

	up_read(&led_cdev->trigger_lock);

	up_read(&triggers_list_lock);



	len += sprintf(len+buf, "\n");

	len += scnprintf(len+buf, PAGE_SIZE - len, "\n");

	return len;

}

EXPORT_SYMBOL_GPL(led_trigger_show);