Why is sprintf with possible buffer overflows allowed in Linux hwmon?

I saw the following code snippet reused for hwmon Linux devices:

return sprintf(buf, "%d\n", in_input);

Where bufis a pointer to char char *buf, or in_inputusually intor u16. The goal is to copy the value read from the device to the sysfs file created for this device attribute.

As an example, you can take a look at Linux / drivers / hwmon / mcp3021.c (or any hwmon device preceding the 4.9 kernel really). You can see that the function on line 81 returns a u16, and on line 99 the code stores u16in char *buf.

 81 static inline u16 volts_from_reg(struct mcp3021_data *data, u16 val)
 82 {
 83         return DIV_ROUND_CLOSEST(data->vdd * val, 1 << data->output_res);
 84 }
 85 
 86 static ssize_t show_in_input(struct device *dev, struct device_attribute *attr,
 87                 char *buf)
 88 {
 89         struct i2c_client *client = to_i2c_client(dev);
 90         struct mcp3021_data *data = i2c_get_clientdata(client);
 91         int reg, in_input;
 92 
 93         reg = mcp3021_read16(client);
 94         if (reg < 0)
 95                 return reg;
 96 
 97         in_input = volts_from_reg(data, reg);
 98 
 99         return sprintf(buf, "%d\n", in_input);
100 }

? u16 , char 8-. Linux?

, , , sysfs , char (8 ). , char * ?

+4
2

sysfs.txt , show, PAGE_SIZE:

sysfs (PAGE_SIZE) . Sysfs .

PAGE_SIZE, , , , .

+4

, , buf 8 , sprintf .

, show_in_input , API snprintf(), .

+2

Source: https://habr.com/ru/post/1666762/


All Articles