atm: use scnprintf() instead of sprintf()

As reported by Chen Gang <gang.chen@asianux.com>, we should ensure there
is enough space when formatting the sysfs buffers.

Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c
index f49da5814bc3c9828829ac2be54ed58b2fbc82a9..350bf62b2ae30023b251070544781328dbd30220 100644 (file)
--- a/net/atm/atm_sysfs.c
+++ b/net/atm/atm_sysfs.c
@@ -14,49 +14,45 @@ static ssize_t show_type(struct device *cdev,
                         struct device_attribute *attr, char *buf)
 {
        struct atm_dev *adev = to_atm_dev(cdev);
-       return sprintf(buf, "%s\n", adev->type);
+
+       return scnprintf(buf, PAGE_SIZE, "%s\n", adev->type);
 }
 
 static ssize_t show_address(struct device *cdev,
                            struct device_attribute *attr, char *buf)
 {
-       char *pos = buf;
        struct atm_dev *adev = to_atm_dev(cdev);
-       int i;
-
-       for (i = 0; i < (ESI_LEN - 1); i++)
-               pos += sprintf(pos, "%02x:", adev->esi[i]);
-       pos += sprintf(pos, "%02x\n", adev->esi[i]);
 
-       return pos - buf;
+       return scnprintf(buf, PAGE_SIZE, "%pM\n", adev->esi);
 }
 
 static ssize_t show_atmaddress(struct device *cdev,
                               struct device_attribute *attr, char *buf)
 {
        unsigned long flags;
-       char *pos = buf;
        struct atm_dev *adev = to_atm_dev(cdev);
        struct atm_dev_addr *aaddr;
        int bin[] = { 1, 2, 10, 6, 1 }, *fmt = bin;
-       int i, j;
+       int i, j, count = 0;
 
        spin_lock_irqsave(&adev->lock, flags);
        list_for_each_entry(aaddr, &adev->local, entry) {
                for (i = 0, j = 0; i < ATM_ESA_LEN; ++i, ++j) {
                        if (j == *fmt) {
-                               pos += sprintf(pos, ".");
+                               count += scnprintf(buf + count,
+                                                  PAGE_SIZE - count, ".");
                                ++fmt;
                                j = 0;
                        }
-                       pos += sprintf(pos, "%02x",
-                                      aaddr->addr.sas_addr.prv[i]);
+                       count += scnprintf(buf + count,
+                                          PAGE_SIZE - count, "%02x",
+                                          aaddr->addr.sas_addr.prv[i]);
                }
-               pos += sprintf(pos, "\n");
+               count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
        }
        spin_unlock_irqrestore(&adev->lock, flags);
 
-       return pos - buf;
+       return count;
 }
 
 static ssize_t show_atmindex(struct device *cdev,
@@ -64,25 +60,21 @@ static ssize_t show_atmindex(struct device *cdev,
 {
        struct atm_dev *adev = to_atm_dev(cdev);
 
-       return sprintf(buf, "%d\n", adev->number);
+       return scnprintf(buf, PAGE_SIZE, "%d\n", adev->number);
 }
 
 static ssize_t show_carrier(struct device *cdev,
                            struct device_attribute *attr, char *buf)
 {
-       char *pos = buf;
        struct atm_dev *adev = to_atm_dev(cdev);
 
-       pos += sprintf(pos, "%d\n",
-                      adev->signal == ATM_PHY_SIG_LOST ? 0 : 1);
-
-       return pos - buf;
+       return scnprintf(buf, PAGE_SIZE, "%d\n",
+                        adev->signal == ATM_PHY_SIG_LOST ? 0 : 1);
 }
 
 static ssize_t show_link_rate(struct device *cdev,
                              struct device_attribute *attr, char *buf)
 {
-       char *pos = buf;
        struct atm_dev *adev = to_atm_dev(cdev);
        int link_rate;
 
@@ -100,9 +92,7 @@ static ssize_t show_link_rate(struct device *cdev,
        default:
                link_rate = adev->link_rate * 8 * 53;
        }
-       pos += sprintf(pos, "%d\n", link_rate);
-
-       return pos - buf;
+       return scnprintf(buf, PAGE_SIZE, "%d\n", link_rate);
 }
 
 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);