summaryrefslogtreecommitdiff
path: root/drivers/thermal
diff options
context:
space:
mode:
authorDan Carpenter <dan.carpenter@oracle.com>2021-09-16 16:13:42 +0300
committerDaniel Lezcano <daniel.lezcano@linaro.org>2021-09-21 16:17:11 +0300
commit1bb30b20b49773369c299d4d6c65227201328663 (patch)
treeb90897c5469d47130ead0f4b869ca353a4e31567 /drivers/thermal
parent8b4bd256674720709a9d858a219fcac6f2f253b5 (diff)
downloadlinux-1bb30b20b49773369c299d4d6c65227201328663.tar.xz
thermal/core: Potential buffer overflow in thermal_build_list_of_policies()
After printing the list of thermal governors, then this function prints a newline character. The problem is that "size" has not been updated after printing the last governor. This means that it can write one character (the NUL terminator) beyond the end of the buffer. Get rid of the "size" variable and just use "PAGE_SIZE - count" directly. Fixes: 1b4f48494eb2 ("thermal: core: group functions related to governor handling") Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org> Link: https://lore.kernel.org/r/20210916131342.GB25094@kili
Diffstat (limited to 'drivers/thermal')
-rw-r--r--drivers/thermal/thermal_core.c7
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/thermal/thermal_core.c b/drivers/thermal/thermal_core.c
index 97ef9b040b84..51374f4e1cca 100644
--- a/drivers/thermal/thermal_core.c
+++ b/drivers/thermal/thermal_core.c
@@ -222,15 +222,14 @@ int thermal_build_list_of_policies(char *buf)
{
struct thermal_governor *pos;
ssize_t count = 0;
- ssize_t size = PAGE_SIZE;
mutex_lock(&thermal_governor_lock);
list_for_each_entry(pos, &thermal_governor_list, governor_list) {
- size = PAGE_SIZE - count;
- count += scnprintf(buf + count, size, "%s ", pos->name);
+ count += scnprintf(buf + count, PAGE_SIZE - count, "%s ",
+ pos->name);
}
- count += scnprintf(buf + count, size, "\n");
+ count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
mutex_unlock(&thermal_governor_lock);