mirror of
https://github.com/torvalds/linux.git
synced 2026-03-08 04:04:43 +01:00
ntb/ntb_tool: correct sscanf format for u64 and size_t in tool_peer_mw_trans_write
The sscanf() call in tool_peer_mw_trans_write() uses "%lli:%zi" to parse user input into 'u64 addr' and 'size_t wsize'. This is incorrect: - "%lli" expects a signed long long *, but 'addr' is u64 (unsigned). Input like "0x8000000000000000" is misinterpreted as negative, leading to corrupted address values. - "%zi" expects a signed ssize_t *, but 'wsize' is size_t (unsigned). Input of "-1" is successfully parsed and stored as SIZE_MAX (e.g., 0xFFFFFFFFFFFFFFFF), which may cause buffer overflows or infinite loops in subsequent memory operations. Fix by using format specifiers that match the actual variable types: - "%llu" for u64 (supports hex/decimal, standard for kernel u64 parsing) - "%zu" for size_t (standard and safe; rejects negative input) Signed-off-by: yangqixiao <yangqixiao@inspur.com> Reviewed-by: Dave Jiang <dave.jiang@intel.com> Signed-off-by: Jon Mason <jdmason@kudzu.us>
This commit is contained in:
parent
4921811678
commit
21fbdc4d0b
1 changed files with 1 additions and 1 deletions
|
|
@ -936,7 +936,7 @@ static ssize_t tool_peer_mw_trans_write(struct file *filep,
|
|||
|
||||
buf[buf_size] = '\0';
|
||||
|
||||
n = sscanf(buf, "%lli:%zi", &addr, &wsize);
|
||||
n = sscanf(buf, "%llu:%zu", &addr, &wsize);
|
||||
if (n != 2)
|
||||
return -EINVAL;
|
||||
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue