dev/parport: fix the array out-of-bounds risk

jira LE-3201
cve CVE-2024-42301
Rebuild_History Non-Buildable kernel-rt-4.18.0-553.27.1.rt7.368.el8_10
commit-author tuhaowen <[email protected]>
commit ab11dac
Empty-Commit: Cherry-Pick Conflicts during history rebuild.
Will be included in final tarball splat. Ref for failed cherry-pick at:
ciq/ciq_backports/kernel-rt-4.18.0-553.27.1.rt7.368.el8_10/ab11dac9.failed

Fixed array out-of-bounds issues caused by sprintf
by replacing it with snprintf for safer data copying,
ensuring the destination buffer is not overflowed.

Below is the stack trace I encountered during the actual issue:

[ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector:
Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport]
[ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm:
QThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2
[ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp
[ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun
PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024
[ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace:
[ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0
[ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20
[ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c
[ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc
[ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38
[ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport]

	Signed-off-by: tuhaowen <[email protected]>
	Cc: stable <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
	Signed-off-by: Greg Kroah-Hartman <[email protected]>
(cherry picked from commit ab11dac)
	Signed-off-by: Jonathan Maple <[email protected]>

# Conflicts:
#	drivers/parport/procfs.c

Author: PlaidCat

ciq/ciq_backports/kernel-rt-4.18.0-553.27.1.rt7.368.el8_10/ab11dac9.failed

@@ -0,0 +1,76 @@
+dev/parport: fix the array out-of-bounds risk
+
+jira LE-3201
+cve CVE-2024-42301
+Rebuild_History Non-Buildable kernel-rt-4.18.0-553.27.1.rt7.368.el8_10
+commit-author tuhaowen <[email protected]>
+commit ab11dac93d2d568d151b1918d7b84c2d02bacbd5
+Empty-Commit: Cherry-Pick Conflicts during history rebuild.
+Will be included in final tarball splat. Ref for failed cherry-pick at:
+ciq/ciq_backports/kernel-rt-4.18.0-553.27.1.rt7.368.el8_10/ab11dac9.failed
+
+Fixed array out-of-bounds issues caused by sprintf
+by replacing it with snprintf for safer data copying,
+ensuring the destination buffer is not overflowed.
+
+Below is the stack trace I encountered during the actual issue:
+
+[ 66.575408s] [pid:5118,cpu4,QThread,4]Kernel panic - not syncing: stack-protector:
+Kernel stack is corrupted in: do_hardware_base_addr+0xcc/0xd0 [parport]
+[ 66.575408s] [pid:5118,cpu4,QThread,5]CPU: 4 PID: 5118 Comm:
+QThread Tainted: G S W O 5.10.97-arm64-desktop #7100.57021.2
+[ 66.575439s] [pid:5118,cpu4,QThread,6]TGID: 5087 Comm: EFileApp
+[ 66.575439s] [pid:5118,cpu4,QThread,7]Hardware name: HUAWEI HUAWEI QingYun
+PGUX-W515x-B081/SP1PANGUXM, BIOS 1.00.07 04/29/2024
+[ 66.575439s] [pid:5118,cpu4,QThread,8]Call trace:
+[ 66.575469s] [pid:5118,cpu4,QThread,9] dump_backtrace+0x0/0x1c0
+[ 66.575469s] [pid:5118,cpu4,QThread,0] show_stack+0x14/0x20
+[ 66.575469s] [pid:5118,cpu4,QThread,1] dump_stack+0xd4/0x10c
+[ 66.575500s] [pid:5118,cpu4,QThread,2] panic+0x1d8/0x3bc
+[ 66.575500s] [pid:5118,cpu4,QThread,3] __stack_chk_fail+0x2c/0x38
+[ 66.575500s] [pid:5118,cpu4,QThread,4] do_hardware_base_addr+0xcc/0xd0 [parport]
+
+	Signed-off-by: tuhaowen <[email protected]>
+	Cc: stable <[email protected]>
+Link: https://lore.kernel.org/r/[email protected]
+	Signed-off-by: Greg Kroah-Hartman <[email protected]>
+(cherry picked from commit ab11dac93d2d568d151b1918d7b84c2d02bacbd5)
+	Signed-off-by: Jonathan Maple <[email protected]>
+
+# Conflicts:
+#	drivers/parport/procfs.c
+diff --cc drivers/parport/procfs.c
+index 48804049d697,c2e371c50dcf..000000000000
+--- a/drivers/parport/procfs.c
++++ b/drivers/parport/procfs.c
+@@@ -113,11 -114,10 +113,11 @@@ static int do_autoprobe(struct ctl_tabl
+  #endif /* IEEE1284.3 support. */
+  
+  static int do_hardware_base_addr(struct ctl_table *table, int write,
+ -				 void *result, size_t *lenp, loff_t *ppos)
+ +				 void __user *result,
+ +				 size_t *lenp, loff_t *ppos)
+  {
+  	struct parport *port = (struct parport *)table->extra1;
+- 	char buffer[20];
++ 	char buffer[64];
+  	int len = 0;
+  
+  	if (*ppos) {
+@@@ -213,7 -210,11 +213,15 @@@ static int do_hardware_modes(struct ctl
+  		return -EACCES;
+  
+  	{
+++<<<<<<< HEAD
+ +#define printmode(x) {if(port->modes&PARPORT_MODE_##x){len+=sprintf(buffer+len,"%s%s",f?",":"",#x);f++;}}
+++=======
++ #define printmode(x)							\
++ do {									\
++ 	if (port->modes & PARPORT_MODE_##x)				\
++ 		len += snprintf(buffer + len, sizeof(buffer) - len, "%s%s", f++ ? "," : "", #x); \
++ } while (0)
+++>>>>>>> ab11dac93d2d (dev/parport: fix the array out-of-bounds risk)
+  		int f = 0;
+  		printmode(PCSPP);
+  		printmode(TRISTATE);
+* Unmerged path drivers/parport/procfs.c