diff options
| author | Josephine Pfeiffer <hi@josie.lol> | 2025-10-01 18:36:22 +0200 |
|---|---|---|
| committer | Heiko Carstens <hca@linux.ibm.com> | 2025-10-21 10:17:20 +0200 |
| commit | dd7d1d34ae484ba2caed8e01e03bdc4c263b1442 (patch) | |
| tree | bfcc033238bb65cd0014e8702d0168be9233b53f | |
| parent | 211ddde0823f1442e4ad052a2f30f050145ccada (diff) | |
| download | linux-dd7d1d34ae484ba2caed8e01e03bdc4c263b1442.tar.gz linux-dd7d1d34ae484ba2caed8e01e03bdc4c263b1442.zip | |
s390/cmm: Replace sprintf() with scnprintf() for buffer safety
Replace sprintf() with scnprintf() in cmm_timeout_handler() to prevent
potential buffer overflow. The scnprintf() function ensures we don't
write beyond the buffer size and provides safer string formatting.
Signed-off-by: Josephine Pfeiffer <hi@josie.lol>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
| -rw-r--r-- | arch/s390/mm/cmm.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c index e2a6eb92420f..eb7ef63fab1e 100644 --- a/arch/s390/mm/cmm.c +++ b/arch/s390/mm/cmm.c @@ -321,8 +321,8 @@ static int cmm_timeout_handler(const struct ctl_table *ctl, int write, cmm_set_timeout(nr, seconds); *ppos += *lenp; } else { - len = sprintf(buf, "%ld %ld\n", - cmm_timeout_pages, cmm_timeout_seconds); + len = scnprintf(buf, sizeof(buf), "%ld %ld\n", + cmm_timeout_pages, cmm_timeout_seconds); if (len > *lenp) len = *lenp; memcpy(buffer, buf, len); |