blk-mq: avoid sysfs buffer overflow with too many CPU cores

It is reported that sysfs buffer overflow can be triggered if the system
has too many CPU cores(>841 on 4K PAGE_SIZE) when showing CPUs of
hctx via /sys/block/$DEV/mq/$N/cpu_list.

Use snprintf to avoid the potential buffer overflow.

This version doesn't change the attribute format, and simply stops
showing CPU numbers if the buffer is going to overflow.

Cc: stable@vger.kernel.org
Fixes: 676141e48af7("blk-mq: don't dump CPU -> hw queue map on driver load")
Signed-off-by: Ming Lei <ming.lei@redhat.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

diff --git a/block/blk-mq-sysfs.c b/block/blk-mq-sysfs.c
index 81a273b4332986e337852d006eb6156017e03de1..4caa56d1bc857b2a3f1c2087dcbefafd2a3a0172 100644 (file)
--- a/block/blk-mq-sysfs.c
+++ b/block/blk-mq-sysfs.c
@@ -158,20 +158,25 @@ static ssize_t blk_mq_hw_sysfs_nr_reserved_tags_show(struct blk_mq_hw_ctx *hctx,
 
 static ssize_t blk_mq_hw_sysfs_cpus_show(struct blk_mq_hw_ctx *hctx, char *page)
 {
+       const size_t size = PAGE_SIZE - 1;
        unsigned int i, first = 1;
-       ssize_t ret = 0;
+       int ret = 0, pos = 0;
 
        for_each_cpu(i, hctx->cpumask) {
                if (first)
-                       ret += sprintf(ret + page, "%u", i);
+                       ret = snprintf(pos + page, size - pos, "%u", i);
                else
-                       ret += sprintf(ret + page, ", %u", i);
+                       ret = snprintf(pos + page, size - pos, ", %u", i);
+
+               if (ret >= size - pos)
+                       break;
 
                first = 0;
+               pos += ret;
        }
 
-       ret += sprintf(ret + page, "\n");
-       return ret;
+       ret = snprintf(pos + page, size - pos, "\n");
+       return pos + ret;
 }
 
 static struct blk_mq_hw_ctx_sysfs_entry blk_mq_hw_sysfs_nr_tags = {