Skip to content

Commit

Permalink
rtc: fix snprintf() checking in is_rtc_hctosys()
Browse files Browse the repository at this point in the history
[ Upstream commit 54b9094 ]

The scnprintf() function silently truncates the printf() and returns
the number bytes that it was able to copy (not counting the NUL
terminator).  Thus, the highest value it can return here is
"NAME_SIZE - 1" and the overflow check is dead code.  Fix this by
using the snprintf() function which returns the number of bytes that
would have been copied if there was enough space and changing the
condition from "> NAME_SIZE" to ">= NAME_SIZE".

Fixes: 92589c9 ("rtc-proc: permit the /proc/driver/rtc device to use other devices")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Alexandre Belloni <alexandre.belloni@bootlin.com>
Link: https://lore.kernel.org/r/YJov/pcGmhLi2pEl@mwanda
Signed-off-by: Sasha Levin <sashal@kernel.org>
  • Loading branch information
Dan Carpenter authored and gregkh committed Jul 20, 2021
1 parent 0b46343 commit 104f724
Showing 1 changed file with 2 additions and 2 deletions.
4 changes: 2 additions & 2 deletions drivers/rtc/proc.c
Expand Up @@ -23,8 +23,8 @@ static bool is_rtc_hctosys(struct rtc_device *rtc)
int size;
char name[NAME_SIZE];

size = scnprintf(name, NAME_SIZE, "rtc%d", rtc->id);
if (size > NAME_SIZE)
size = snprintf(name, NAME_SIZE, "rtc%d", rtc->id);
if (size >= NAME_SIZE)
return false;

return !strncmp(name, CONFIG_RTC_HCTOSYS_DEVICE, NAME_SIZE);
Expand Down

0 comments on commit 104f724

Please sign in to comment.