hwmon: (ibmpowernv) Use scnprintf() for avoiding potential buffer overflow

Since snprintf() returns the would-be-output size instead of the
actual output size, the succeeding calls may go beyond the given
buffer limit.  Fix it by replacing with scnprintf().

Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>

diff --git a/drivers/hwmon/ibmpowernv.c b/drivers/hwmon/ibmpowernv.c
index 0e525cf..a750647 100644 (file)
--- a/drivers/hwmon/ibmpowernv.c
+++ b/drivers/hwmon/ibmpowernv.c
@@ -186,7 +186,7 @@ static void make_sensor_label(struct device_node *np,
        u32 id;
        size_t n;
 
-       n = snprintf(sdata->label, sizeof(sdata->label), "%s", label);
+       n = scnprintf(sdata->label, sizeof(sdata->label), "%s", label);
 
        /*
         * Core temp pretty print
@@ -199,11 +199,11 @@ static void make_sensor_label(struct device_node *np,
                         * The digital thermal sensors are associated
                         * with a core.
                         */
-                       n += snprintf(sdata->label + n,
+                       n += scnprintf(sdata->label + n,
                                      sizeof(sdata->label) - n, " %d",
                                      cpuid);
                else
-                       n += snprintf(sdata->label + n,
+                       n += scnprintf(sdata->label + n,
                                      sizeof(sdata->label) - n, " phy%d", id);
        }
 
@@ -211,7 +211,7 @@ static void make_sensor_label(struct device_node *np,
         * Membuffer pretty print
         */
        if (!of_property_read_u32(np, "ibm,chip-id", &id))
-               n += snprintf(sdata->label + n, sizeof(sdata->label) - n,
+               n += scnprintf(sdata->label + n, sizeof(sdata->label) - n,
                              " %d", id & 0xffff);
 }