[PATCH] staging: fbtft: Use sysfs_emit_at() to print to sysfs file

[PATCH] staging: fbtft: Use sysfs_emit_at() to print to sysfs file

[Dan Carpenter]

This scnprintf() uses the wrong limit.  It should be "PAGE_SIZE - len"
instead of just PAGE_SIZE.  We're not going to hit the limit in real
life since we are printing at most FBTFT_GAMMA_MAX_VALUES_TOTAL (128)
u32 values, however, it's still worth fixing.

Use sysfs_emit_at() to fix this since this is a sysfs file.

Fixes: c296d5f9957c ("staging: fbtft: core support")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
 drivers/staging/fbtft/fbtft-sysfs.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/staging/fbtft/fbtft-sysfs.c b/drivers/staging/fbtft/fbtft-sysfs.c
index d05599d80011..343545e83a37 100644
--- a/drivers/staging/fbtft/fbtft-sysfs.c
+++ b/drivers/staging/fbtft/fbtft-sysfs.c
@@ -98,7 +98,7 @@ sprintf_gamma(struct fbtft_par *par, u32 *curves, char *buf)
 	mutex_lock(&par->gamma.lock);
 	for (i = 0; i < par->gamma.num_curves; i++) {
 		for (j = 0; j < par->gamma.num_values; j++)
-			len += scnprintf(&buf[len], PAGE_SIZE,
+			len += sysfs_emit_at(buf, len,
 			     "%04x ", curves[i * par->gamma.num_values + j]);
 		buf[len - 1] = '\n';
 	}
-- 
2.53.0

Re: [PATCH] staging: fbtft: Use sysfs_emit_at() to print to sysfs file

[Andy Shevchenko]

On Wed, Jun 03, 2026 at 10:34:21AM +0300, Dan Carpenter wrote:
> This scnprintf() uses the wrong limit.  It should be "PAGE_SIZE - len"
> instead of just PAGE_SIZE.  We're not going to hit the limit in real
> life since we are printing at most FBTFT_GAMMA_MAX_VALUES_TOTAL (128)
> u32 values, however, it's still worth fixing.
> 
> Use sysfs_emit_at() to fix this since this is a sysfs file.

OK,
Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>

...

>  	for (i = 0; i < par->gamma.num_curves; i++) {
>  		for (j = 0; j < par->gamma.num_values; j++)
> -			len += scnprintf(&buf[len], PAGE_SIZE,
> +			len += sysfs_emit_at(buf, len,
>  			     "%04x ", curves[i * par->gamma.num_values + j]);

Can we switch to use hex_dump_to_buffer() at some point?

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH] staging: fbtft: Use sysfs_emit_at() to print to sysfs file

[David Laight]

On Wed, 3 Jun 2026 10:49:11 +0300
Andy Shevchenko <andriy.shevchenko@intel.com> wrote:

> On Wed, Jun 03, 2026 at 10:34:21AM +0300, Dan Carpenter wrote:
> > This scnprintf() uses the wrong limit.  It should be "PAGE_SIZE - len"
> > instead of just PAGE_SIZE.  We're not going to hit the limit in real
> > life since we are printing at most FBTFT_GAMMA_MAX_VALUES_TOTAL (128)
> > u32 values, however, it's still worth fixing.
> > 
> > Use sysfs_emit_at() to fix this since this is a sysfs file.  
> 
> OK,
> Reviewed-by: Andy Shevchenko <andriy.shevchenko@intel.com>
> 
> ...
> 
> >  	for (i = 0; i < par->gamma.num_curves; i++) {
> >  		for (j = 0; j < par->gamma.num_values; j++)
> > -			len += scnprintf(&buf[len], PAGE_SIZE,
> > +			len += sysfs_emit_at(buf, len,
> >  			     "%04x ", curves[i * par->gamma.num_values + j]);  
> 
> Can we switch to use hex_dump_to_buffer() at some point?
> 

That gets hard when you really want to aim for something nearer seq_printf().

Oh, the way the loops in the code are written doesn't look like
it gives the compiler much chance of optimising it very well.
This is probably equivalent:
	for (i = par->gamma.num_curves; i--;) {
		for (j = par->gamma.num_values; j--;)
			len += sysfs_emit_at(buf, len, "%04x ", *curves++);
		buf[len - 1] = '\n';
	}
and will generate much better code.
(Although most of the cost inside the snprintf() function - which is horrid.)
num_values better be non-zero.

-- David

Claude review: staging: fbtft: Use sysfs_emit_at() to print to sysfs file

[Claude Code Review Bot]

Patch Review

**The bug:** In `sprintf_gamma()` at line 101, the original code passes `PAGE_SIZE` as the size limit to `scnprintf()`:

```c
len += scnprintf(&buf[len], PAGE_SIZE,
     "%04x ", curves[i * par->gamma.num_values + j]);
```

Since the write starts at `&buf[len]`, the correct limit should be `PAGE_SIZE - len`. Passing the full `PAGE_SIZE` means `scnprintf` thinks it has more buffer space than actually remains, which could theoretically write past the end of the page-sized sysfs buffer.

**The fix:** Replaces this with `sysfs_emit_at(buf, len, ...)`:

```c
len += sysfs_emit_at(buf, len,
     "%04x ", curves[i * par->gamma.num_values + j]);
```

`sysfs_emit_at()` internally computes `PAGE_SIZE - offset` for the limit and also adds safety checks (page-alignment verification, offset bounds checking), making it the correct and idiomatic API for sysfs show callbacks.

**Correctness:** Verified that this is indeed a sysfs context — `sprintf_gamma()` is called from `show_gamma_curve()` (line 142), which is the show callback registered via `__ATTR(gamma, 0660, show_gamma_curve, store_gamma_curve)` at line 146. The companion function `show_debug()` at line 198 already uses `sysfs_emit()`, so this change also improves consistency within the file.

**Practical impact:** As the commit message correctly notes, the max output is `FBTFT_GAMMA_MAX_VALUES_TOTAL` (128) u32 values formatted as `"%04x "` (5 chars each) = ~640 bytes, well under `PAGE_SIZE` (4096). So this is a correctness fix rather than a security-critical one, but still worth having.

**No issues found.** Reviewed-by worthy.

---
Generated by Claude Code Patch Reviewer

Claude review: staging: fbtft: Use sysfs_emit_at() to print to sysfs file

[Claude Code Review Bot]

Overall Series Review

Subject: staging: fbtft: Use sysfs_emit_at() to print to sysfs file
Author: Dan Carpenter <error27@gmail.com>
Patches: 3
Reviewed: 2026-06-04T11:55:20.660926

---

This is a single patch from Dan Carpenter fixing a buffer size limit bug in the fbtft staging driver's sysfs gamma curve display function. The fix is correct and uses the proper kernel sysfs API. The commit message is clear, accurately describes the bug and its (low) practical impact, and includes an appropriate `Fixes:` tag.

**Verdict: Looks good.** A clean, well-motivated janitor fix.

---
Generated by Claude Code Patch Reviewer