atm: use scnprintf() instead of sprintf()

As reported by Chen Gang <gang.chen@asianux.com>, we should ensure there
is enough space when formatting the sysfs buffers.

Signed-off-by: Chas Williams <chas@cmf.nrl.navy.mil>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 15 insertions, 25 deletions

diff --git a/net/atm/atm_sysfs.c b/net/atm/atm_sysfs.c
index f49da5814bc3..350bf62b2ae3 100644
--- a/net/atm/atm_sysfs.c
+++ b/net/atm/atm_sysfs.c
@@ -14,49 +14,45 @@ static ssize_t show_type(struct device *cdev,
                          struct device_attribute *attr, char *buf)
 {
         struct atm_dev *adev = to_atm_dev(cdev);
-        return sprintf(buf, "%s\n", adev->type);
+
+        return scnprintf(buf, PAGE_SIZE, "%s\n", adev->type);
 }
 
 static ssize_t show_address(struct device *cdev,
                             struct device_attribute *attr, char *buf)
 {
-        char *pos = buf;
         struct atm_dev *adev = to_atm_dev(cdev);
-        int i;
-
-        for (i = 0; i < (ESI_LEN - 1); i++)
-                pos += sprintf(pos, "%02x:", adev->esi[i]);
-        pos += sprintf(pos, "%02x\n", adev->esi[i]);
 
-        return pos - buf;
+        return scnprintf(buf, PAGE_SIZE, "%pM\n", adev->esi);
 }
 
 static ssize_t show_atmaddress(struct device *cdev,
                                struct device_attribute *attr, char *buf)
 {
         unsigned long flags;
-        char *pos = buf;
         struct atm_dev *adev = to_atm_dev(cdev);
         struct atm_dev_addr *aaddr;
         int bin[] = { 1, 2, 10, 6, 1 }, *fmt = bin;
-        int i, j;
+        int i, j, count = 0;
 
         spin_lock_irqsave(&adev->lock, flags);
         list_for_each_entry(aaddr, &adev->local, entry) {
                 for (i = 0, j = 0; i < ATM_ESA_LEN; ++i, ++j) {
                         if (j == *fmt) {
-                                pos += sprintf(pos, ".");
+                                count += scnprintf(buf + count,
+                                                   PAGE_SIZE - count, ".");
                                 ++fmt;
                                 j = 0;
                         }
-                        pos += sprintf(pos, "%02x",
-                                       aaddr->addr.sas_addr.prv[i]);
+                        count += scnprintf(buf + count,
+                                           PAGE_SIZE - count, "%02x",
+                                           aaddr->addr.sas_addr.prv[i]);
                 }
-                pos += sprintf(pos, "\n");
+                count += scnprintf(buf + count, PAGE_SIZE - count, "\n");
         }
         spin_unlock_irqrestore(&adev->lock, flags);
 
-        return pos - buf;
+        return count;
 }
 
 static ssize_t show_atmindex(struct device *cdev,
@@ -64,25 +60,21 @@ static ssize_t show_atmindex(struct device *cdev,
 {
         struct atm_dev *adev = to_atm_dev(cdev);
 
-        return sprintf(buf, "%d\n", adev->number);
+        return scnprintf(buf, PAGE_SIZE, "%d\n", adev->number);
 }
 
 static ssize_t show_carrier(struct device *cdev,
                             struct device_attribute *attr, char *buf)
 {
-        char *pos = buf;
         struct atm_dev *adev = to_atm_dev(cdev);
 
-        pos += sprintf(pos, "%d\n",
-                       adev->signal == ATM_PHY_SIG_LOST ? 0 : 1);
-
-        return pos - buf;
+        return scnprintf(buf, PAGE_SIZE, "%d\n",
+                         adev->signal == ATM_PHY_SIG_LOST ? 0 : 1);
 }
 
 static ssize_t show_link_rate(struct device *cdev,
                               struct device_attribute *attr, char *buf)
 {
-        char *pos = buf;
         struct atm_dev *adev = to_atm_dev(cdev);
         int link_rate;
 
@@ -100,9 +92,7 @@ static ssize_t show_link_rate(struct device *cdev,
         default:
                 link_rate = adev->link_rate * 8 * 53;
         }
-        pos += sprintf(pos, "%d\n", link_rate);
-
-        return pos - buf;
+        return scnprintf(buf, PAGE_SIZE, "%d\n", link_rate);
 }
 
 static DEVICE_ATTR(address, S_IRUGO, show_address, NULL);