diff mbox series

[v1,1/1] Input: atkbd - bail out when device path can't fit buffer

Message ID 20250422185657.1949429-1-andriy.shevchenko@linux.intel.com
State New
Headers show
Series [v1,1/1] Input: atkbd - bail out when device path can't fit buffer | expand

Commit Message

Andy Shevchenko April 22, 2025, 6:56 p.m. UTC 
When creating a physical device name in the driver the snprintf() takes
an up to 32 characters argument along with the additional 8 characters
and tries to pack this into 32 bytes array. GCC complains about that
when build with `make W=1`:

drivers/input/keyboard/atkbd.c:1194:9: note: ‘snprintf’ output between 8 and 39 bytes into a destination of size 32
 1194 |         snprintf(atkbd->phys, sizeof(atkbd->phys),
      |         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 1195 |                  "%s/input0", atkbd->ps2dev.serio->phys);
      |                  ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Fix these by checking for the potential overflow.

Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
---
 drivers/input/keyboard/atkbd.c | 17 ++++++++++++-----
 1 file changed, 12 insertions(+), 5 deletions(-)
diff mbox series

Patch

diff --git a/drivers/input/keyboard/atkbd.c b/drivers/input/keyboard/atkbd.c
index adf0f311996c..e5d6880ceef6 100644
--- a/drivers/input/keyboard/atkbd.c
+++ b/drivers/input/keyboard/atkbd.c
@@ -1178,10 +1178,10 @@  static void atkbd_set_keycode_table(struct atkbd *atkbd)
  * atkbd_set_device_attrs() sets up keyboard's input device structure
  */
 
-static void atkbd_set_device_attrs(struct atkbd *atkbd)
+static int atkbd_set_device_attrs(struct atkbd *atkbd)
 {
 	struct input_dev *input_dev = atkbd->dev;
-	int i;
+	int i, n;
 
 	if (atkbd->extra)
 		snprintf(atkbd->name, sizeof(atkbd->name),
@@ -1191,8 +1191,10 @@  static void atkbd_set_device_attrs(struct atkbd *atkbd)
 			 "AT %s Set %d keyboard",
 			 atkbd->translated ? "Translated" : "Raw", atkbd->set);
 
-	snprintf(atkbd->phys, sizeof(atkbd->phys),
-		 "%s/input0", atkbd->ps2dev.serio->phys);
+	n = snprintf(atkbd->phys, sizeof(atkbd->phys),
+		     "%s/input0", atkbd->ps2dev.serio->phys);
+	if (n >= sizeof(atkbd->phys))
+		return -E2BIG;
 
 	input_dev->name = atkbd->name;
 	input_dev->phys = atkbd->phys;
@@ -1245,6 +1247,8 @@  static void atkbd_set_device_attrs(struct atkbd *atkbd)
 			__set_bit(atkbd->keycode[i], input_dev->keybit);
 		}
 	}
+
+	return 0;
 }
 
 static void atkbd_parse_fwnode_data(struct serio *serio)
@@ -1331,7 +1335,10 @@  static int atkbd_connect(struct serio *serio, struct serio_driver *drv)
 	atkbd_parse_fwnode_data(serio);
 
 	atkbd_set_keycode_table(atkbd);
-	atkbd_set_device_attrs(atkbd);
+
+	err = atkbd_set_device_attrs(atkbd);
+	if (err)
+		goto fail3;
 
 	atkbd_enable(atkbd);
 	if (serio->write)