From f68334a85ee9120678c06a8da4a1711be7be86a2 Mon Sep 17 00:00:00 2001
From: Takashi Iwai <tiwai@suse.de>
Date: Tue, 18 Feb 2020 09:22:08 +0100
Subject: [PATCH] md/raid0: Fix buffer overflow at debug print
Patch-mainline: Not yet, waiting for patch author posting upstream
References: bsc#1164051
The debug print text in dump_zones() is formatted via a loop of
snprintf(). Since snprintf() returns the number of would-be-printed
characters, not the actually output, the length calculation in the
loop overflows the actual buffer size, which leads to a WARNING in
vsnprintf().
Replace snprintf() with scnprintf() to calculate properly with the
actual output size.
Cc: <stable@vger.kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Coly Li <colyli@suse.de>
---
drivers/md/raid0.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/md/raid0.c b/drivers/md/raid0.c
index 322386ff5d22..3e16be05b98f 100644
--- a/drivers/md/raid0.c
+++ b/drivers/md/raid0.c
@@ -63,7 +63,7 @@ static void dump_zones(struct mddev *mddev)
int len = 0;
for (k = 0; k < conf->strip_zone[j].nb_dev; k++)
- len += snprintf(line+len, 200-len, "%s%s", k?"/":"",
+ len += scnprintf(line+len, 200-len, "%s%s", k?"/":"",
bdevname(conf->devlist[j*raid_disks
+ k]->bdev, b));
pr_debug("md: zone%d=[%s]\n", j, line);
--
2.16.4