[PATCH] PCI: rpaphp: Fix stack overflows when constructing DRC names
From: Yudi Yang <hidden>
Date: 2026-09-09 17:33:50
Also in:
linux-pci, lkml
Subsystem:
ibm power pci hotplug driver for rpa-compliant ppc64 platform, linux for powerpc (32-bit and 64-bit), pci subsystem, the rest · Maintainers:
Tyrel Datwyler, Madhavan Srinivasan, Bjorn Helgaas, Linus Torvalds
The drc-name-prefix field of ibm,drc-info is supplied by firmware and
is not limited to fit within MAX_DRC_NAME_LEN. Using sprintf() to append
a suffix can therefore overflow the stack buffers used for DRC names.
Use snprintf() and reject names that would be truncated.
Fixes: 2fcf3ae508c2 ("hotplug/drc-info: Add code to search ibm,drc-info property")
Cc: stable@vger.kernel.org
Signed-off-by: Yudi Yang <redacted>
---
drivers/pci/hotplug/rpaphp_core.c | 11 ++++++++---
1 file changed, 8 insertions(+), 3 deletions(-)
diff --git a/drivers/pci/hotplug/rpaphp_core.c b/drivers/pci/hotplug/rpaphp_core.c
index 2316de0fd198..39109a50fee6 100644
--- a/drivers/pci/hotplug/rpaphp_core.c
+++ b/drivers/pci/hotplug/rpaphp_core.c@@ -252,8 +252,11 @@ static int rpaphp_check_drc_props_v2(struct device_node *dn, char *drc_name, /* Found it */ if (my_index >= drc.drc_index_start && my_index <= drc.last_drc_index) { int index = my_index - drc.drc_index_start; - sprintf(cell_drc_name, "%s%d", drc.drc_name_prefix, - drc.drc_name_suffix_start + index); + + if (snprintf(cell_drc_name, sizeof(cell_drc_name), "%s%u", + drc.drc_name_prefix, + drc.drc_name_suffix_start + index) >= sizeof(cell_drc_name)) + return -EINVAL; break; } }
@@ -355,7 +358,9 @@ static int rpaphp_drc_info_add_slot(struct device_node *dn) if (!is_php_type(drc.drc_type)) return 0; - sprintf(drc_name, "%s%d", drc.drc_name_prefix, drc.drc_name_suffix_start); + if (snprintf(drc_name, sizeof(drc_name), "%s%u", drc.drc_name_prefix, + drc.drc_name_suffix_start) >= sizeof(drc_name)) + return -EINVAL; slot = alloc_slot_struct(dn, drc.drc_index_start, drc_name, drc.drc_power_domain); if (!slot)
--
2.43.0