[PATCH] snprintf fixes

From: Juergen Quade <quade@hsnr.de>

Lots of places in the kernel are using [v]snprintf wrongly: they assume it
returns the number of characters copied.  It doesn't.  It returns the
number of characters which _would_ have been copied had the buffer not been
filled up.

So create new functions vscnprintf() and scnprintf() which have the
expected (sane) semaptics, and migrate callers over to using them.

arch/i386/kernel/edd.c

@@ -134,18 +134,18 @@ edd_show_host_bus(struct edd_device *edev, char *buf)
 
 	for (i = 0; i < 4; i++) {
 		if (isprint(info->params.host_bus_type[i])) {
-			p += snprintf(p, left, "%c", info->params.host_bus_type[i]);
+			p += scnprintf(p, left, "%c", info->params.host_bus_type[i]);
 		} else {
-			p += snprintf(p, left, " ");
+			p += scnprintf(p, left, " ");
 		}
 	}
 
 	if (!strncmp(info->params.host_bus_type, "ISA", 3)) {
-		p += snprintf(p, left, "\tbase_address: %x\n",
+		p += scnprintf(p, left, "\tbase_address: %x\n",
 			     info->params.interface_path.isa.base_address);
 	} else if (!strncmp(info->params.host_bus_type, "PCIX", 4) ||
 		   !strncmp(info->params.host_bus_type, "PCI", 3)) {
-		p += snprintf(p, left,
+		p += scnprintf(p, left,
 			     "\t%02x:%02x.%d  channel: %u\n",
 			     info->params.interface_path.pci.bus,
 			     info->params.interface_path.pci.slot,
@@ -154,12 +154,12 @@ edd_show_host_bus(struct edd_device *edev, char *buf)
 	} else if (!strncmp(info->params.host_bus_type, "IBND", 4) ||
 		   !strncmp(info->params.host_bus_type, "XPRS", 4) ||
 		   !strncmp(info->params.host_bus_type, "HTPT", 4)) {
-		p += snprintf(p, left,
+		p += scnprintf(p, left,
 			     "\tTBD: %llx\n",
 			     info->params.interface_path.ibnd.reserved);
 
 	} else {
-		p += snprintf(p, left, "\tunknown: %llx\n",
+		p += scnprintf(p, left, "\tunknown: %llx\n",
 			     info->params.interface_path.unknown.reserved);
 	}
 	return (p - buf);
@@ -178,43 +178,43 @@ edd_show_interface(struct edd_device *edev, char *buf)
 
 	for (i = 0; i < 8; i++) {
 		if (isprint(info->params.interface_type[i])) {
-			p += snprintf(p, left, "%c", info->params.interface_type[i]);
+			p += scnprintf(p, left, "%c", info->params.interface_type[i]);
 		} else {
-			p += snprintf(p, left, " ");
+			p += scnprintf(p, left, " ");
 		}
 	}
 	if (!strncmp(info->params.interface_type, "ATAPI", 5)) {
-		p += snprintf(p, left, "\tdevice: %u  lun: %u\n",
+		p += scnprintf(p, left, "\tdevice: %u  lun: %u\n",
 			     info->params.device_path.atapi.device,
 			     info->params.device_path.atapi.lun);
 	} else if (!strncmp(info->params.interface_type, "ATA", 3)) {
-		p += snprintf(p, left, "\tdevice: %u\n",
+		p += scnprintf(p, left, "\tdevice: %u\n",
 			     info->params.device_path.ata.device);
 	} else if (!strncmp(info->params.interface_type, "SCSI", 4)) {
-		p += snprintf(p, left, "\tid: %u  lun: %llu\n",
+		p += scnprintf(p, left, "\tid: %u  lun: %llu\n",
 			     info->params.device_path.scsi.id,
 			     info->params.device_path.scsi.lun);
 	} else if (!strncmp(info->params.interface_type, "USB", 3)) {
-		p += snprintf(p, left, "\tserial_number: %llx\n",
+		p += scnprintf(p, left, "\tserial_number: %llx\n",
 			     info->params.device_path.usb.serial_number);
 	} else if (!strncmp(info->params.interface_type, "1394", 4)) {
-		p += snprintf(p, left, "\teui: %llx\n",
+		p += scnprintf(p, left, "\teui: %llx\n",
 			     info->params.device_path.i1394.eui);
 	} else if (!strncmp(info->params.interface_type, "FIBRE", 5)) {
-		p += snprintf(p, left, "\twwid: %llx lun: %llx\n",
+		p += scnprintf(p, left, "\twwid: %llx lun: %llx\n",
 			     info->params.device_path.fibre.wwid,
 			     info->params.device_path.fibre.lun);
 	} else if (!strncmp(info->params.interface_type, "I2O", 3)) {
-		p += snprintf(p, left, "\tidentity_tag: %llx\n",
+		p += scnprintf(p, left, "\tidentity_tag: %llx\n",
 			     info->params.device_path.i2o.identity_tag);
 	} else if (!strncmp(info->params.interface_type, "RAID", 4)) {
-		p += snprintf(p, left, "\tidentity_tag: %x\n",
+		p += scnprintf(p, left, "\tidentity_tag: %x\n",
 			     info->params.device_path.raid.array_number);
 	} else if (!strncmp(info->params.interface_type, "SATA", 4)) {
-		p += snprintf(p, left, "\tdevice: %u\n",
+		p += scnprintf(p, left, "\tdevice: %u\n",
 			     info->params.device_path.sata.device);
 	} else {
-		p += snprintf(p, left, "\tunknown: %llx %llx\n",
+		p += scnprintf(p, left, "\tunknown: %llx %llx\n",
 			     info->params.device_path.unknown.reserved1,
 			     info->params.device_path.unknown.reserved2);
 	}
@@ -256,7 +256,7 @@ edd_show_version(struct edd_device *edev, char *buf)
 		return -EINVAL;
 	}
 
-	p += snprintf(p, left, "0x%02x\n", info->version);
+	p += scnprintf(p, left, "0x%02x\n", info->version);
 	return (p - buf);
 }
 
@@ -264,7 +264,7 @@ static ssize_t
 edd_show_disk80_sig(struct edd_device *edev, char *buf)
 {
 	char *p = buf;
-	p += snprintf(p, left, "0x%08x\n", edd_disk80_sig);
+	p += scnprintf(p, left, "0x%08x\n", edd_disk80_sig);
 	return (p - buf);
 }
 
@@ -278,16 +278,16 @@ edd_show_extensions(struct edd_device *edev, char *buf)
 	}
 
 	if (info->interface_support & EDD_EXT_FIXED_DISK_ACCESS) {
-		p += snprintf(p, left, "Fixed disk access\n");
+		p += scnprintf(p, left, "Fixed disk access\n");
 	}
 	if (info->interface_support & EDD_EXT_DEVICE_LOCKING_AND_EJECTING) {
-		p += snprintf(p, left, "Device locking and ejecting\n");
+		p += scnprintf(p, left, "Device locking and ejecting\n");
 	}
 	if (info->interface_support & EDD_EXT_ENHANCED_DISK_DRIVE_SUPPORT) {
-		p += snprintf(p, left, "Enhanced Disk Drive support\n");
+		p += scnprintf(p, left, "Enhanced Disk Drive support\n");
 	}
 	if (info->interface_support & EDD_EXT_64BIT_EXTENSIONS) {
-		p += snprintf(p, left, "64-bit extensions\n");
+		p += scnprintf(p, left, "64-bit extensions\n");
 	}
 	return (p - buf);
 }
@@ -302,21 +302,21 @@ edd_show_info_flags(struct edd_device *edev, char *buf)
 	}
 
 	if (info->params.info_flags & EDD_INFO_DMA_BOUNDARY_ERROR_TRANSPARENT)
-		p += snprintf(p, left, "DMA boundary error transparent\n");
+		p += scnprintf(p, left, "DMA boundary error transparent\n");
 	if (info->params.info_flags & EDD_INFO_GEOMETRY_VALID)
-		p += snprintf(p, left, "geometry valid\n");
+		p += scnprintf(p, left, "geometry valid\n");
 	if (info->params.info_flags & EDD_INFO_REMOVABLE)
-		p += snprintf(p, left, "removable\n");
+		p += scnprintf(p, left, "removable\n");
 	if (info->params.info_flags & EDD_INFO_WRITE_VERIFY)
-		p += snprintf(p, left, "write verify\n");
+		p += scnprintf(p, left, "write verify\n");
 	if (info->params.info_flags & EDD_INFO_MEDIA_CHANGE_NOTIFICATION)
-		p += snprintf(p, left, "media change notification\n");
+		p += scnprintf(p, left, "media change notification\n");
 	if (info->params.info_flags & EDD_INFO_LOCKABLE)
-		p += snprintf(p, left, "lockable\n");
+		p += scnprintf(p, left, "lockable\n");
 	if (info->params.info_flags & EDD_INFO_NO_MEDIA_PRESENT)
-		p += snprintf(p, left, "no media present\n");
+		p += scnprintf(p, left, "no media present\n");
 	if (info->params.info_flags & EDD_INFO_USE_INT13_FN50)
-		p += snprintf(p, left, "use int13 fn50\n");
+		p += scnprintf(p, left, "use int13 fn50\n");
 	return (p - buf);
 }
 
@@ -329,7 +329,7 @@ edd_show_default_cylinders(struct edd_device *edev, char *buf)
 		return -EINVAL;
 	}
 
-	p += snprintf(p, left, "0x%x\n", info->params.num_default_cylinders);
+	p += scnprintf(p, left, "0x%x\n", info->params.num_default_cylinders);
 	return (p - buf);
 }
 
@@ -342,7 +342,7 @@ edd_show_default_heads(struct edd_device *edev, char *buf)
 		return -EINVAL;
 	}
 
-	p += snprintf(p, left, "0x%x\n", info->params.num_default_heads);
+	p += scnprintf(p, left, "0x%x\n", info->params.num_default_heads);
 	return (p - buf);
 }
 
@@ -355,7 +355,7 @@ edd_show_default_sectors_per_track(struct edd_device *edev, char *buf)
 		return -EINVAL;
 	}
 
-	p += snprintf(p, left, "0x%x\n", info->params.sectors_per_track);
+	p += scnprintf(p, left, "0x%x\n", info->params.sectors_per_track);
 	return (p - buf);
 }
 
@@ -368,7 +368,7 @@ edd_show_sectors(struct edd_device *edev, char *buf)
 		return -EINVAL;
 	}
 
-	p += snprintf(p, left, "0x%llx\n", info->params.number_of_sectors);
+	p += scnprintf(p, left, "0x%llx\n", info->params.number_of_sectors);
 	return (p - buf);
 }
 

arch/ppc64/kernel/lparcfg.c

@@ -134,7 +134,7 @@ static int lparcfg_data(unsigned char *buf, unsigned long size)
 	memset(buf, 0, size); 
 
 	shared = (int)(lpaca->xLpPacaPtr->xSharedProc);
-	n += snprintf(buf, LPARCFG_BUFF_SIZE - n,
+	n += scnprintf(buf, LPARCFG_BUFF_SIZE - n,
 		      "serial_number=%c%c%c%c%c%c%c\n", 
 		      e2a(xItExtVpdPanel.mfgID[2]),
 		      e2a(xItExtVpdPanel.mfgID[3]),
@@ -144,7 +144,7 @@ static int lparcfg_data(unsigned char *buf, unsigned long size)
 		      e2a(xItExtVpdPanel.systemSerial[4]),
 		      e2a(xItExtVpdPanel.systemSerial[5])); 
 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "system_type=%c%c%c%c\n",
 		      e2a(xItExtVpdPanel.machineType[0]),
 		      e2a(xItExtVpdPanel.machineType[1]),
@@ -152,23 +152,23 @@ static int lparcfg_data(unsigned char *buf, unsigned long size)
 		      e2a(xItExtVpdPanel.machineType[3])); 
 
 	lp_index = HvLpConfig_getLpIndex(); 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "partition_id=%d\n", (int)lp_index); 
 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "system_active_processors=%d\n", 
 		      (int)HvLpConfig_getSystemPhysicalProcessors()); 
 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "system_potential_processors=%d\n", 
 		      (int)HvLpConfig_getSystemPhysicalProcessors()); 
 
 	processors = (int)HvLpConfig_getPhysicalProcessors(); 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "partition_active_processors=%d\n", processors);  
 
 	max_processors = (int)HvLpConfig_getMaxPhysicalProcessors(); 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "partition_potential_processors=%d\n", max_processors);  
 
 	if(shared) {
@@ -178,22 +178,22 @@ static int lparcfg_data(unsigned char *buf, unsigned long size)
 		entitled_capacity = processors * 100; 
 		max_entitled_capacity = max_processors * 100; 
 	}
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "partition_entitled_capacity=%d\n", entitled_capacity);
 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "partition_max_entitled_capacity=%d\n", 
 		      max_entitled_capacity);
 
 	if(shared) {
 		pool_id = HvLpConfig_getSharedPoolIndex(); 
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, "pool=%d\n", 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n, "pool=%d\n",
 			      (int)pool_id); 
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "pool_capacity=%d\n", (int)(HvLpConfig_getNumProcsInSharedPool(pool_id)*100)); 
 	}
 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "shared_processor_mode=%d\n", shared);
 
 	return 0;
@@ -297,13 +297,13 @@ static int lparcfg_data(unsigned char *buf, unsigned long size)
 		if(lp_index_ptr) lp_index = *lp_index_ptr;
 	}
 
-	n  = snprintf(buf, LPARCFG_BUFF_SIZE - n,
+	n  = scnprintf(buf, LPARCFG_BUFF_SIZE - n,
 		      "serial_number=%s\n", system_id); 
 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "system_type=%s\n", model); 
 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "partition_id=%d\n", (int)lp_index); 
 
 	rtas_node = find_path_device("/rtas");
@@ -317,74 +317,74 @@ static int lparcfg_data(unsigned char *buf, unsigned long size)
 	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR) {
 		h_get_ppp(&h_entitled,&h_unallocated,&h_aggregation,&h_resource);
 #ifdef DEBUG
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "R4=0x%lx\n", h_entitled);
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "R5=0x%lx\n", h_unallocated);
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "R6=0x%lx\n", h_aggregation);
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "R7=0x%lx\n", h_resource);
 #endif /* DEBUG */
 	}
 
 	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR) {
 		system_potential_processors =  get_splpar_potential_characteristics();
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "system_active_processors=%ld\n", 
 			      (h_resource >> 2*8) & 0xffff);
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "system_potential_processors=%d\n", 
 			      system_potential_processors);
 	} else {
 		system_potential_processors = system_active_processors;
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "system_active_processors=%d\n", 
 			      system_active_processors);
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "system_potential_processors=%d\n", 
 			      system_potential_processors);
 	}
 
 	processors = systemcfg->processorCount;
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "partition_active_processors=%d\n", processors);  
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "partition_potential_processors=%d\n",
 		      system_active_processors);
 
 	/* max_entitled_capacity will come out of get_splpar_potential_characteristics() when that function is complete */
 	max_entitled_capacity = system_active_processors * 100; 
 	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR) {
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "partition_entitled_capacity=%ld\n", h_entitled);
 	} else {
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "partition_entitled_capacity=%d\n", system_active_processors*100);
 	}
 
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "partition_max_entitled_capacity=%d\n", 
 		      max_entitled_capacity);
 
 	shared = 0;
-	n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+	n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 		      "shared_processor_mode=%d\n", shared);
 
 	if (cur_cpu_spec->firmware_features & FW_FEATURE_SPLPAR) {
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "pool=%ld\n", (h_aggregation >> 0*8)&0xffff);
 
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "pool_capacity=%ld\n", (h_resource >> 3*8) &0xffff);
 
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "group=%ld\n", (h_aggregation >> 2*8)&0xffff);
 
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "capped=%ld\n", (h_resource >> 6*8)&0x40);
 
-		n += snprintf(buf+n, LPARCFG_BUFF_SIZE - n, 
+		n += scnprintf(buf+n, LPARCFG_BUFF_SIZE - n,
 			      "capacity_weight=%d\n", (int)(h_resource>>5*8)&0xFF);
 	}
 	return 0;

arch/ppc64/kernel/rtas-proc.c

@@ -287,9 +287,9 @@ static ssize_t ppc_rtas_poweron_read(struct file * file, char * buf,
 	char stkbuf[40];  /* its small, its on stack */
 	int n, sn;
 	if (power_on_time == 0)
-		n = snprintf(stkbuf, 40, "Power on time not set\n");
+		n = scnprintf(stkbuf,sizeof(stkbuf),"Power on time not set\n");
 	else
-		n = snprintf(stkbuf, 40, "%lu\n", power_on_time);
+		n = scnprintf(stkbuf,sizeof(stkbuf),"%lu\n",power_on_time);
 
 	sn = strlen (stkbuf) +1;
 	if (*ppos >= sn)
@@ -410,9 +410,10 @@ static ssize_t ppc_rtas_clock_read(struct file * file, char * buf,
 	if (error != 0){
 		printk(KERN_WARNING "error: reading the clock returned: %s\n", 
 				ppc_rtas_process_error(error));
-		n = snprintf (stkbuf, 40, "0");
+		n = scnprintf (stkbuf, sizeof(stkbuf), "0");
 	} else { 
-		n = snprintf (stkbuf, 40, "%lu\n", mktime(year, mon, day, hour, min, sec));
+		n = scnprintf (stkbuf, sizeof(stkbuf), "%lu\n",
+				mktime(year, mon, day, hour, min, sec));
 	}
 	kfree(ret);
 
@@ -819,7 +820,7 @@ int get_location_code(struct individual_sensor s, char * buffer)
 		n += check_location_string(ret, buffer + n);
 		n += sprintf ( buffer+n, " ");
 		/* see how many characters we have printed */
-		snprintf ( t, 50, "%s ", ret);
+		scnprintf(t, sizeof(t), "%s ", ret);
 
 		pos += strlen(t);
 		if (pos >= llen) pos=0;
@@ -863,7 +864,7 @@ static ssize_t ppc_rtas_tone_freq_read(struct file * file, char * buf,
 	int n, sn;
 	char stkbuf[40];  /* its small, its on stack */
 
-	n = snprintf(stkbuf, 40, "%lu\n", rtas_tone_frequency);
+	n = scnprintf(stkbuf, 40, "%lu\n", rtas_tone_frequency);
 
 	sn = strlen (stkbuf) +1;
 	if (*ppos >= sn)
@@ -917,7 +918,7 @@ static ssize_t ppc_rtas_tone_volume_read(struct file * file, char * buf,
 	int n, sn;
 	char stkbuf[40];  /* its small, its on stack */
 
-	n = snprintf(stkbuf, 40, "%lu\n", rtas_tone_volume);
+	n = scnprintf(stkbuf, 40, "%lu\n", rtas_tone_volume);
 
 	sn = strlen (stkbuf) +1;
 	if (*ppos >= sn)

arch/sparc/prom/printf.c

@@ -39,7 +39,7 @@ prom_printf(char *fmt, ...)
 	int i;
 
 	va_start(args, fmt);
-	i = vsnprintf(ppbuf, sizeof(ppbuf), fmt, args);
+	i = vscnprintf(ppbuf, sizeof(ppbuf), fmt, args);
 	va_end(args);
 
 	prom_write(ppbuf, i);

arch/sparc64/prom/printf.c

@@ -40,7 +40,7 @@ prom_printf(char *fmt, ...)
 	int i;
 
 	va_start(args, fmt);
-	i = vsnprintf(ppbuf, sizeof(ppbuf), fmt, args);
+	i = vscnprintf(ppbuf, sizeof(ppbuf), fmt, args);
 	va_end(args);
 
 	prom_write(ppbuf, i);

arch/x86_64/kernel/early_printk.c

@@ -164,7 +164,7 @@ void early_printk(const char *fmt, ...)
 	va_list ap;
 
 	va_start(ap,fmt); 
-	n = vsnprintf(buf,512,fmt,ap);
+	n = vscnprintf(buf,512,fmt,ap);
 	early_console->write(early_console,buf,n);
 	va_end(ap); 
 } 

drivers/base/dmapool.c

@@ -52,7 +52,7 @@ show_pools (struct device *dev, char *buf)
 	next = buf;
 	size = PAGE_SIZE;
 
-	temp = snprintf (next, size, "poolinfo - 0.1\n");
+	temp = scnprintf(next, size, "poolinfo - 0.1\n");
 	size -= temp;
 	next += temp;
 
@@ -67,7 +67,7 @@ show_pools (struct device *dev, char *buf)
 		}
 
 		/* per-pool info, no real statistics yet */
-		temp = snprintf (next, size, "%-16s %4u %4Zu %4Zu %2u\n",
+		temp = scnprintf(next, size, "%-16s %4u %4Zu %4Zu %2u\n",
 				pool->name,
 				blocks, pages * pool->blocks_per_page,
 				pool->size, pages);

drivers/char/sn_serial.c

@@ -259,7 +259,7 @@ sn_debug_printf(const char *fmt, ...)
 	va_list args;
 
 	va_start(args, fmt);
-	printed_len = vsnprintf(printk_buf, sizeof(printk_buf), fmt, args);
+	printed_len = vscnprintf(printk_buf, sizeof(printk_buf), fmt, args);
 	early_printk_sn_sal(printk_buf, printed_len);
 	va_end(args);
 	return printed_len;

drivers/char/viocons.c

@@ -149,7 +149,7 @@ void hvlog(char *fmt, ...)
 
 	spin_lock_irqsave(&consoleloglock, flags);
 	va_start(args, fmt);
-	i = vsnprintf(buf, sizeof(buf) - 1, fmt, args);
+	i = vscnprintf(buf, sizeof(buf) - 1, fmt, args);
 	va_end(args);
 	buf[i++] = '\r';
 	HvCall_writeLogBuffer(buf, i);

drivers/cpufreq/cpufreq.c

@@ -198,7 +198,7 @@ static ssize_t show_scaling_governor (struct cpufreq_policy * policy, char *buf)
 	else if (policy->policy == CPUFREQ_POLICY_PERFORMANCE)
 		return sprintf(buf, "performance\n");
 	else if (policy->governor)
-		return snprintf(buf, CPUFREQ_NAME_LEN, "%s\n", policy->governor->name);
+		return scnprintf(buf, CPUFREQ_NAME_LEN, "%s\n", policy->governor->name);
 	return -EINVAL;
 }
 
@@ -234,7 +234,7 @@ static ssize_t store_scaling_governor (struct cpufreq_policy * policy,
  */
 static ssize_t show_scaling_driver (struct cpufreq_policy * policy, char *buf)
 {
-	return snprintf(buf, CPUFREQ_NAME_LEN, "%s\n", cpufreq_driver->name);
+	return scnprintf(buf, CPUFREQ_NAME_LEN, "%s\n", cpufreq_driver->name);
 }
 
 /**
@@ -254,7 +254,7 @@ static ssize_t show_scaling_available_governors (struct cpufreq_policy * policy,
 	list_for_each_entry(t, &cpufreq_governor_list, governor_list) {
 		if (i >= (ssize_t) ((PAGE_SIZE / sizeof(char)) - (CPUFREQ_NAME_LEN + 2)))
 			goto out;
-		i += snprintf(&buf[i], CPUFREQ_NAME_LEN, "%s ", t->name);
+		i += scnprintf(&buf[i], CPUFREQ_NAME_LEN, "%s ", t->name);
 	}
  out:
 	i += sprintf(&buf[i], "\n");

drivers/cpufreq/proc_intf.c

@@ -139,7 +139,7 @@ static int cpufreq_proc_read (
 				break;
 			} 
 		} else
-			p += snprintf(p, CPUFREQ_NAME_LEN, "%s\n", policy.governor->name);
+			p += scnprintf(p, CPUFREQ_NAME_LEN, "%s\n", policy.governor->name);
 	}
 end:
 	len = (p - page);

drivers/md/dm-stripe.c

@@ -195,12 +195,12 @@ static int stripe_status(struct dm_target *ti,
 		break;
 
 	case STATUSTYPE_TABLE:
-		offset = snprintf(result, maxlen, "%d " SECTOR_FORMAT,
+		offset = scnprintf(result, maxlen, "%d " SECTOR_FORMAT,
 				  sc->stripes, sc->chunk_mask + 1);
 		for (i = 0; i < sc->stripes; i++) {
 			format_dev_t(buffer, sc->stripe[i].dev->bdev->bd_dev);
 			offset +=
-			    snprintf(result + offset, maxlen - offset,
+			    scnprintf(result + offset, maxlen - offset,
 				     " %s " SECTOR_FORMAT, buffer,
 				     sc->stripe[i].physical_start);
 		}

drivers/media/video/videocodec.c

@@ -392,15 +392,15 @@ videocodec_build_table (void)
 	videocodec_buf = (char *) kmalloc(size, GFP_KERNEL);
 
 	i = 0;
-	i += snprintf(videocodec_buf + i, size - 1,
+	i += scnprintf(videocodec_buf + i, size - 1,
 		      "<S>lave or attached <M>aster name  type flags    magic    ");
-	i += snprintf(videocodec_buf + i, size - 1, "(connected as)\n");
+	i += scnprintf(videocodec_buf + i, size -i - 1, "(connected as)\n");
 
 	h = codeclist_top;
 	while (h) {
 		if (i > (size - LINESIZE))
 			break;	// security check
-		i += snprintf(videocodec_buf + i, size,
+		i += scnprintf(videocodec_buf + i, size -i -1,
 			      "S %32s %04x %08lx %08lx (TEMPLATE)\n",
 			      h->codec->name, h->codec->type,
 			      h->codec->flags, h->codec->magic);
@@ -408,7 +408,7 @@ videocodec_build_table (void)
 		while (a) {
 			if (i > (size - LINESIZE))
 				break;	// security check
-			i += snprintf(videocodec_buf + i, size,
+			i += scnprintf(videocodec_buf + i, size -i -1,
 				      "M %32s %04x %08lx %08lx (%s)\n",
 				      a->codec->master_data->name,
 				      a->codec->master_data->type,

drivers/parisc/dino.c

@@ -475,7 +475,7 @@ dino_card_setup(struct pci_bus *bus, unsigned long base_addr)
 
 	res = &dino_dev->hba.lmmio_space;
 	res->flags = IORESOURCE_MEM;
-	size = snprintf(name, sizeof(name), "Dino LMMIO (%s)", bus->bridge->bus_id);
+	size = scnprintf(name, sizeof(name), "Dino LMMIO (%s)", bus->bridge->bus_id);
 	res->name = kmalloc(size+1, GFP_KERNEL);
 	if(res->name)
 		strcpy((char *)res->name, name);

drivers/pci/hotplug.c

@@ -29,7 +29,7 @@ int pci_hotplug (struct device *dev, char **envp, int num_envp,
 
 	/* stuff we want to pass to /sbin/hotplug */
 	envp[i++] = scratch;
-	length += snprintf (scratch, buffer_size - length, "PCI_CLASS=%04X",
+	length += scnprintf (scratch, buffer_size - length, "PCI_CLASS=%04X",
 			    pdev->class);
 	if ((buffer_size - length <= 0) || (i >= num_envp))
 		return -ENOMEM;
@@ -37,7 +37,7 @@ int pci_hotplug (struct device *dev, char **envp, int num_envp,
 	scratch += length;
 
 	envp[i++] = scratch;
-	length += snprintf (scratch, buffer_size - length, "PCI_ID=%04X:%04X",
+	length += scnprintf (scratch, buffer_size - length, "PCI_ID=%04X:%04X",
 			    pdev->vendor, pdev->device);
 	if ((buffer_size - length <= 0) || (i >= num_envp))
 		return -ENOMEM;
@@ -45,7 +45,7 @@ int pci_hotplug (struct device *dev, char **envp, int num_envp,
 	scratch += length;
 
 	envp[i++] = scratch;
-	length += snprintf (scratch, buffer_size - length,
+	length += scnprintf (scratch, buffer_size - length,
 			    "PCI_SUBSYS_ID=%04X:%04X", pdev->subsystem_vendor,
 			    pdev->subsystem_device);
 	if ((buffer_size - length <= 0) || (i >= num_envp))
@@ -54,7 +54,7 @@ int pci_hotplug (struct device *dev, char **envp, int num_envp,
 	scratch += length;
 
 	envp[i++] = scratch;
-	length += snprintf (scratch, buffer_size - length, "PCI_SLOT_NAME=%s",
+	length += scnprintf (scratch, buffer_size - length, "PCI_SLOT_NAME=%s",
 			    pci_name(pdev));
 	if ((buffer_size - length <= 0) || (i >= num_envp))
 		return -ENOMEM;

drivers/s390/char/tape_core.c

@@ -81,7 +81,7 @@ tape_medium_state_show(struct device *dev, char *buf)
 	struct tape_device *tdev;
 
 	tdev = (struct tape_device *) dev->driver_data;
-	return snprintf(buf, PAGE_SIZE, "%i\n", tdev->medium_state);
+	return scnprintf(buf, PAGE_SIZE, "%i\n", tdev->medium_state);
 }
 
 static
@@ -93,7 +93,7 @@ tape_first_minor_show(struct device *dev, char *buf)
 	struct tape_device *tdev;
 
 	tdev = (struct tape_device *) dev->driver_data;
-	return snprintf(buf, PAGE_SIZE, "%i\n", tdev->first_minor);
+	return scnprintf(buf, PAGE_SIZE, "%i\n", tdev->first_minor);
 }
 
 static
@@ -105,7 +105,7 @@ tape_state_show(struct device *dev, char *buf)
 	struct tape_device *tdev;
 
 	tdev = (struct tape_device *) dev->driver_data;
-	return snprintf(buf, PAGE_SIZE, "%s\n", (tdev->first_minor < 0) ?
+	return scnprintf(buf, PAGE_SIZE, "%s\n", (tdev->first_minor < 0) ?
 		"OFFLINE" : tape_state_verbose[tdev->tape_state]);
 }
 
@@ -120,17 +120,17 @@ tape_operation_show(struct device *dev, char *buf)
 
 	tdev = (struct tape_device *) dev->driver_data;
 	if (tdev->first_minor < 0)
-		return snprintf(buf, PAGE_SIZE, "N/A\n");
+		return scnprintf(buf, PAGE_SIZE, "N/A\n");
 
 	spin_lock_irq(get_ccwdev_lock(tdev->cdev));
 	if (list_empty(&tdev->req_queue))
-		rc = snprintf(buf, PAGE_SIZE, "---\n");
+		rc = scnprintf(buf, PAGE_SIZE, "---\n");
 	else {
 		struct tape_request *req;
 
 		req = list_entry(tdev->req_queue.next, struct tape_request,
 			list);
-		rc = snprintf(buf, PAGE_SIZE, "%s\n", tape_op_verbose[req->op]);
+		rc = scnprintf(buf,PAGE_SIZE, "%s\n", tape_op_verbose[req->op]);
 	}
 	spin_unlock_irq(get_ccwdev_lock(tdev->cdev));
 	return rc;
@@ -146,7 +146,7 @@ tape_blocksize_show(struct device *dev, char *buf)
 
 	tdev = (struct tape_device *) dev->driver_data;
 
-	return snprintf(buf, PAGE_SIZE, "%i\n", tdev->char_data.block_size);
+	return scnprintf(buf, PAGE_SIZE, "%i\n", tdev->char_data.block_size);
 }
 
 static

drivers/s390/cio/device.c

@@ -73,7 +73,7 @@ ccw_hotplug (struct device *dev, char **envp, int num_envp,
 	/* what we want to pass to /sbin/hotplug */
 
 	envp[i++] = buffer;
-	length += snprintf(buffer, buffer_size - length, "CU_TYPE=%04X",
+	length += scnprintf(buffer, buffer_size - length, "CU_TYPE=%04X",
 			   cdev->id.cu_type);
 	if ((buffer_size - length <= 0) || (i >= num_envp))
 		return -ENOMEM;
@@ -81,7 +81,7 @@ ccw_hotplug (struct device *dev, char **envp, int num_envp,
 	buffer += length;
 
 	envp[i++] = buffer;
-	length += snprintf(buffer, buffer_size - length, "CU_MODEL=%02X",
+	length += scnprintf(buffer, buffer_size - length, "CU_MODEL=%02X",
 			   cdev->id.cu_model);
 	if ((buffer_size - length <= 0) || (i >= num_envp))
 		return -ENOMEM;
@@ -90,7 +90,7 @@ ccw_hotplug (struct device *dev, char **envp, int num_envp,
 
 	/* The next two can be zero, that's ok for us */
 	envp[i++] = buffer;
-	length += snprintf(buffer, buffer_size - length, "DEV_TYPE=%04X",
+	length += scnprintf(buffer, buffer_size - length, "DEV_TYPE=%04X",
 			   cdev->id.dev_type);
 	if ((buffer_size - length <= 0) || (i >= num_envp))
 		return -ENOMEM;
@@ -98,7 +98,7 @@ ccw_hotplug (struct device *dev, char **envp, int num_envp,
 	buffer += length;
 
 	envp[i++] = buffer;
-	length += snprintf(buffer, buffer_size - length, "DEV_MODEL=%02X",
+	length += scnprintf(buffer, buffer_size - length, "DEV_MODEL=%02X",
 			   cdev->id.dev_model);
 	if ((buffer_size - length <= 0) || (i >= num_envp))
 		return -ENOMEM;

drivers/scsi/scsi_debug.c

@@ -557,8 +557,7 @@ static int resp_inquiry(unsigned char * cmd, int target, unsigned char * buff,
 		
 		dev_id_num = ((devip->sdbg_host->shost->host_no + 1) * 2000) +
 			     (devip->target * 1000) + devip->lun;
-		len = snprintf(dev_id_str, 6, "%d", dev_id_num);
-		len = (len > 6) ? 6 : len;
+		len = scnprintf(dev_id_str, 6, "%d", dev_id_num);
 		if (0 == cmd[2]) { /* supported vital product data pages */
 			arr[3] = 3;
 			arr[4] = 0x0; /* this page */
@@ -1309,7 +1308,7 @@ static int scsi_debug_proc_info(struct Scsi_Host *host, char *buffer, char **sta
 
 static ssize_t sdebug_delay_show(struct device_driver * ddp, char * buf) 
 {
-        return snprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_delay);
+        return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_delay);
 }
 
 static ssize_t sdebug_delay_store(struct device_driver * ddp, 
@@ -1331,7 +1330,7 @@ DRIVER_ATTR(delay, S_IRUGO | S_IWUSR, sdebug_delay_show,
 
 static ssize_t sdebug_opts_show(struct device_driver * ddp, char * buf) 
 {
-        return snprintf(buf, PAGE_SIZE, "0x%x\n", scsi_debug_opts);
+        return scnprintf(buf, PAGE_SIZE, "0x%x\n", scsi_debug_opts);
 }
 
 static ssize_t sdebug_opts_store(struct device_driver * ddp, 
@@ -1360,7 +1359,7 @@ DRIVER_ATTR(opts, S_IRUGO | S_IWUSR, sdebug_opts_show,
 
 static ssize_t sdebug_num_tgts_show(struct device_driver * ddp, char * buf) 
 {
-        return snprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_num_tgts);
+        return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_num_tgts);
 }
 static ssize_t sdebug_num_tgts_store(struct device_driver * ddp, 
 				     const char * buf, size_t count)
@@ -1378,13 +1377,13 @@ DRIVER_ATTR(num_tgts, S_IRUGO | S_IWUSR, sdebug_num_tgts_show,
 
 static ssize_t sdebug_dev_size_mb_show(struct device_driver * ddp, char * buf) 
 {
-        return snprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dev_size_mb);
+        return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_dev_size_mb);
 }
 DRIVER_ATTR(dev_size_mb, S_IRUGO, sdebug_dev_size_mb_show, NULL) 
 
 static ssize_t sdebug_every_nth_show(struct device_driver * ddp, char * buf) 
 {
-        return snprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_every_nth);
+        return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_every_nth);
 }
 static ssize_t sdebug_every_nth_store(struct device_driver * ddp, 
 				      const char * buf, size_t count)
@@ -1403,7 +1402,7 @@ DRIVER_ATTR(every_nth, S_IRUGO | S_IWUSR, sdebug_every_nth_show,
 
 static ssize_t sdebug_max_luns_show(struct device_driver * ddp, char * buf) 
 {
-        return snprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_max_luns);
+        return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_max_luns);
 }
 static ssize_t sdebug_max_luns_store(struct device_driver * ddp, 
 				     const char * buf, size_t count)
@@ -1421,13 +1420,13 @@ DRIVER_ATTR(max_luns, S_IRUGO | S_IWUSR, sdebug_max_luns_show,
 
 static ssize_t sdebug_scsi_level_show(struct device_driver * ddp, char * buf) 
 {
-        return snprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_scsi_level);
+        return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_scsi_level);
 }
 DRIVER_ATTR(scsi_level, S_IRUGO, sdebug_scsi_level_show, NULL) 
 
 static ssize_t sdebug_add_host_show(struct device_driver * ddp, char * buf) 
 {
-        return snprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_add_host);
+        return scnprintf(buf, PAGE_SIZE, "%d\n", scsi_debug_add_host);
 }
 
 static ssize_t sdebug_add_host_store(struct device_driver * ddp, 

drivers/usb/gadget/goku_udc.c

@@ -1111,7 +1111,7 @@ dump_intmask(const char *label, u32 mask, char **next, unsigned *size)
 	int t;
 
 	/* int_status is the same format ... */
-	t = snprintf(*next, *size,
+	t = scnprintf(*next, *size,
 		"%s %05X =" FOURBITS EIGHTBITS EIGHTBITS "\n",
 		label, mask,
 		(mask & INT_PWRDETECT) ? " power" : "",
@@ -1164,7 +1164,7 @@ udc_proc_read(char *buffer, char **start, off_t off, int count,
 	/* basic device status */
 	tmp = readl(&regs->power_detect);
 	is_usb_connected = tmp & PW_DETECT;
-	t = snprintf(next, size,
+	t = scnprintf(next, size,
 		"%s - %s\n"
 		"%s version: %s %s\n"
 		"Gadget driver: %s\n"
@@ -1198,7 +1198,7 @@ udc_proc_read(char *buffer, char **start, off_t off, int count,
 		goto done;
 
 	/* registers for (active) device and ep0 */
-	t = snprintf(next, size, "\nirqs %lu\ndataset %02x "
+	t = scnprintf(next, size, "\nirqs %lu\ndataset %02x "
 			"single.bcs %02x.%02x state %x addr %u\n",
 			dev->irqs, readl(&regs->DataSet),
 			readl(&regs->EPxSingle), readl(&regs->EPxBCS),
@@ -1208,7 +1208,7 @@ udc_proc_read(char *buffer, char **start, off_t off, int count,
 	next += t;
 
 	tmp = readl(&regs->dma_master);
-	t = snprintf(next, size,
+	t = scnprintf(next, size,
 		"dma %03X =" EIGHTBITS "%s %s\n", tmp,
 		(tmp & MST_EOPB_DIS) ? " eopb-" : "",
 		(tmp & MST_EOPB_ENA) ? " eopb+" : "",
@@ -1237,7 +1237,7 @@ udc_proc_read(char *buffer, char **start, off_t off, int count,
 			continue;
 
 		tmp = readl(ep->reg_status);
-		t = snprintf(next, size,
+		t = scnprintf(next, size,
 			"%s %s max %u %s, irqs %lu, "
 			"status %02x (%s) " FOURBITS "\n",
 			ep->ep.name,
@@ -1277,7 +1277,7 @@ udc_proc_read(char *buffer, char **start, off_t off, int count,
 		next += t;
 
 		if (list_empty(&ep->queue)) {
-			t = snprintf(next, size, "\t(nothing queued)\n");
+			t = scnprintf(next, size, "\t(nothing queued)\n");
 			if (t <= 0 || t > size)
 				goto done;
 			size -= t;
@@ -1295,7 +1295,7 @@ udc_proc_read(char *buffer, char **start, off_t off, int count,
 			} else
 				tmp = req->req.actual;
 
-			t = snprintf(next, size,
+			t = scnprintf(next, size,
 				"\treq %p len %u/%u buf %p\n",
 				&req->req, tmp, req->req.length,
 				req->req.buf);
@@ -1913,7 +1913,7 @@ static int goku_probe(struct pci_dev *pdev, const struct pci_device_id *id)
 	INFO(dev, "%s\n", driver_desc);
 	INFO(dev, "version: " DRIVER_VERSION " %s\n", dmastr());
 #ifndef __sparc__
-	snprintf(buf, sizeof buf, "%d", pdev->irq);
+	scnprintf(buf, sizeof buf, "%d", pdev->irq);
 	bufp = buf;
 #else
 	bufp = __irq_itoa(pdev->irq);

drivers/usb/gadget/net2280.c

@@ -1439,7 +1439,7 @@ show_function (struct device *_dev, char *buf)
 			|| !dev->driver->function
 			|| strlen (dev->driver->function) > PAGE_SIZE)
 		return 0;
-	return snprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
+	return scnprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
 }
 static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
 
@@ -1465,7 +1465,7 @@ show_registers (struct device *_dev, char *buf)
 		s = "(none)";
 
 	/* Main Control Registers */
-	t = snprintf (next, size, "%s version " DRIVER_VERSION
+	t = scnprintf (next, size, "%s version " DRIVER_VERSION
 			", chiprev %04x, dma %s\n\n"
 			"devinit %03x fifoctl %08x gadget '%s'\n"
 			"pci irqenb0 %02x irqenb1 %08x "
@@ -1497,7 +1497,7 @@ show_registers (struct device *_dev, char *buf)
 		/* full speed bit (6) not working?? */
 	} else
 			s = "not attached";
-	t = snprintf (next, size,
+	t = scnprintf (next, size,
 			"stdrsp %08x usbctl %08x usbstat %08x "
 				"addr 0x%02x (%s)\n",
 			readl (&dev->usb->stdrsp), t1, t2,
@@ -1519,7 +1519,7 @@ show_registers (struct device *_dev, char *buf)
 
 		t1 = readl (&ep->regs->ep_cfg);
 		t2 = readl (&ep->regs->ep_rsp) & 0xff;
-		t = snprintf (next, size,
+		t = scnprintf (next, size,
 				"\n%s\tcfg %05x rsp (%02x) %s%s%s%s%s%s%s%s"
 					"irqenb %02x\n",
 				ep->ep.name, t1, t2,
@@ -1543,7 +1543,7 @@ show_registers (struct device *_dev, char *buf)
 		size -= t;
 		next += t;
 
-		t = snprintf (next, size,
+		t = scnprintf (next, size,
 				"\tstat %08x avail %04x "
 				"(ep%d%s-%s)%s\n",
 				readl (&ep->regs->ep_stat),
@@ -1557,7 +1557,7 @@ show_registers (struct device *_dev, char *buf)
 		if (!ep->dma)
 			continue;
 
-		t = snprintf (next, size,
+		t = scnprintf (next, size,
 				"  dma\tctl %08x stat %08x count %08x\n"
 				"\taddr %08x desc %08x\n",
 				readl (&ep->dma->dmactl),
@@ -1574,7 +1574,7 @@ show_registers (struct device *_dev, char *buf)
 		// none yet 
 
 	/* Statistics */
-	t = snprintf (next, size, "\nirqs:  ");
+	t = scnprintf (next, size, "\nirqs:  ");
 	size -= t;
 	next += t;
 	for (i = 0; i < 7; i++) {
@@ -1583,12 +1583,12 @@ show_registers (struct device *_dev, char *buf)
 		ep = &dev->ep [i];
 		if (i && !ep->irqs)
 			continue;
-		t = snprintf (next, size, " %s/%lu", ep->ep.name, ep->irqs);
+		t = scnprintf (next, size, " %s/%lu", ep->ep.name, ep->irqs);
 		size -= t;
 		next += t;
 
 	}
-	t = snprintf (next, size, "\n");
+	t = scnprintf (next, size, "\n");
 	size -= t;
 	next += t;
 
@@ -1624,7 +1624,7 @@ show_queues (struct device *_dev, char *buf)
 			if (!d)
 				continue;
 			t = d->bEndpointAddress;
-			t = snprintf (next, size,
+			t = scnprintf (next, size,
 				"\n%s (ep%d%s-%s) max %04x %s fifo %d\n",
 				ep->ep.name, t & USB_ENDPOINT_NUMBER_MASK,
 				(t & USB_DIR_IN) ? "in" : "out",
@@ -1641,7 +1641,7 @@ show_queues (struct device *_dev, char *buf)
 				ep->dma ? "dma" : "pio", ep->fifo_size
 				);
 		} else /* ep0 should only have one transfer queued */
-			t = snprintf (next, size, "ep0 max 64 pio %s\n",
+			t = scnprintf (next, size, "ep0 max 64 pio %s\n",
 					ep->is_in ? "in" : "out");
 		if (t <= 0 || t > size)
 			goto done;
@@ -1649,7 +1649,7 @@ show_queues (struct device *_dev, char *buf)
 		next += t;
 
 		if (list_empty (&ep->queue)) {
-			t = snprintf (next, size, "\t(nothing queued)\n");
+			t = scnprintf (next, size, "\t(nothing queued)\n");
 			if (t <= 0 || t > size)
 				goto done;
 			size -= t;
@@ -1658,14 +1658,14 @@ show_queues (struct device *_dev, char *buf)
 		}
 		list_for_each_entry (req, &ep->queue, queue) {
 			if (ep->dma && req->td_dma == readl (&ep->dma->dmadesc))
-				t = snprintf (next, size,
+				t = scnprintf (next, size,
 					"\treq %p len %d/%d "
 					"buf %p (dmacount %08x)\n",
 					&req->req, req->req.actual,
 					req->req.length, req->req.buf,
 					readl (&ep->dma->dmacount));
 			else
-				t = snprintf (next, size,
+				t = scnprintf (next, size,
 					"\treq %p len %d/%d buf %p\n",
 					&req->req, req->req.actual,
 					req->req.length, req->req.buf);
@@ -1678,7 +1678,7 @@ show_queues (struct device *_dev, char *buf)
 				struct net2280_dma	*td;
 
 				td = req->td;
-				t = snprintf (next, size, "\t    td %08x "
+				t = scnprintf (next, size, "\t    td %08x "
 					" count %08x buf %08x desc %08x\n",
 					req->td_dma, td->dmacount,
 					td->dmaaddr, td->dmadesc);
@@ -2788,7 +2788,7 @@ static int net2280_probe (struct pci_dev *pdev, const struct pci_device_id *id)
 		goto done;
 	}
 #ifndef __sparc__
-	snprintf (buf, sizeof buf, "%d", pdev->irq);
+	scnprintf (buf, sizeof buf, "%d", pdev->irq);
 	bufp = buf;
 #else
 	bufp = __irq_itoa(pdev->irq);

drivers/usb/gadget/pxa2xx_udc.c

@@ -1232,7 +1232,7 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 	local_irq_save(flags);
 
 	/* basic device status */
-	t = snprintf(next, size, DRIVER_DESC "\n"
+	t = scnprintf(next, size, DRIVER_DESC "\n"
 		"%s version: %s\nGadget driver: %s\nHost %s\n\n",
 		driver_name, DRIVER_VERSION SIZE_STR DMASTR,
 		dev->driver ? dev->driver->driver.name : "(none)",
@@ -1241,14 +1241,14 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 	next += t;
 
 	/* registers for device and ep0 */
-	t = snprintf(next, size,
+	t = scnprintf(next, size,
 		"uicr %02X.%02X, usir %02X.%02x, ufnr %02X.%02X\n",
 		UICR1, UICR0, USIR1, USIR0, UFNRH, UFNRL);
 	size -= t;
 	next += t;
 
 	tmp = UDCCR;
-	t = snprintf(next, size,
+	t = scnprintf(next, size,
 		"udccr %02X =%s%s%s%s%s%s%s%s\n", tmp,
 		(tmp & UDCCR_REM) ? " rem" : "",
 		(tmp & UDCCR_RSTIR) ? " rstir" : "",
@@ -1262,7 +1262,7 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 	next += t;
 
 	tmp = UDCCS0;
-	t = snprintf(next, size,
+	t = scnprintf(next, size,
 		"udccs0 %02X =%s%s%s%s%s%s%s%s\n", tmp,
 		(tmp & UDCCS0_SA) ? " sa" : "",
 		(tmp & UDCCS0_RNE) ? " rne" : "",
@@ -1277,7 +1277,7 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 
 	if (dev->has_cfr) {
 		tmp = UDCCFR;
-		t = snprintf(next, size,
+		t = scnprintf(next, size,
 			"udccfr %02X =%s%s\n", tmp,
 			(tmp & UDCCFR_AREN) ? " aren" : "",
 			(tmp & UDCCFR_ACM) ? " acm" : "");
@@ -1288,7 +1288,7 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 	if (!is_usb_connected() || !dev->driver)
 		goto done;
 
-	t = snprintf(next, size, "ep0 IN %lu/%lu, OUT %lu/%lu\nirqs %lu\n\n",
+	t = scnprintf(next, size, "ep0 IN %lu/%lu, OUT %lu/%lu\nirqs %lu\n\n",
 		dev->stats.write.bytes, dev->stats.write.ops,
 		dev->stats.read.bytes, dev->stats.read.ops,
 		dev->stats.irqs);
@@ -1308,7 +1308,7 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 			if (!d)
 				continue;
 			tmp = *dev->ep [i].reg_udccs;
-			t = snprintf(next, size,
+			t = scnprintf(next, size,
 				"%s max %d %s udccs %02x irqs %lu/%lu\n",
 				ep->ep.name, le16_to_cpu (d->wMaxPacketSize),
 				(ep->dma >= 0) ? "dma" : "pio", tmp,
@@ -1316,7 +1316,7 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 			/* TODO translate all five groups of udccs bits! */
 
 		} else /* ep0 should only have one transfer queued */
-			t = snprintf(next, size, "ep0 max 16 pio irqs %lu\n",
+			t = scnprintf(next, size, "ep0 max 16 pio irqs %lu\n",
 				ep->pio_irqs);
 		if (t <= 0 || t > size)
 			goto done;
@@ -1324,7 +1324,7 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 		next += t;
 
 		if (list_empty(&ep->queue)) {
-			t = snprintf(next, size, "\t(nothing queued)\n");
+			t = scnprintf(next, size, "\t(nothing queued)\n");
 			if (t <= 0 || t > size)
 				goto done;
 			size -= t;
@@ -1334,7 +1334,7 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 		list_for_each_entry(req, &ep->queue, queue) {
 #ifdef	USE_DMA
 			if (ep->dma >= 0 && req->queue.prev == &ep->queue)
-				t = snprintf(next, size,
+				t = scnprintf(next, size,
 					"\treq %p len %d/%d "
 					"buf %p (dma%d dcmd %08x)\n",
 					&req->req, req->req.actual,
@@ -1344,7 +1344,7 @@ udc_proc_read(char *page, char **start, off_t off, int count,
 					);
 			else
 #endif
-				t = snprintf(next, size,
+				t = scnprintf(next, size,
 					"\treq %p len %d/%d buf %p\n",
 					&req->req, req->req.actual,
 					req->req.length, req->req.buf);
@@ -1382,7 +1382,7 @@ show_function (struct device *_dev, char *buf)
 			|| !dev->driver->function
 			|| strlen (dev->driver->function) > PAGE_SIZE)
 		return 0;
-	return snprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
+	return scnprintf (buf, PAGE_SIZE, "%s\n", dev->driver->function);
 }
 static DEVICE_ATTR (function, S_IRUGO, show_function, NULL);
 

drivers/usb/host/ehci-dbg.c

@@ -173,7 +173,7 @@ dbg_itd (const char *label, struct ehci_hcd *ehci, struct ehci_itd *itd)
 static int __attribute__((__unused__))
 dbg_status_buf (char *buf, unsigned len, char *label, u32 status)
 {
-	return snprintf (buf, len,
+	return scnprintf (buf, len,
 		"%s%sstatus %04x%s%s%s%s%s%s%s%s%s%s",
 		label, label [0] ? " " : "", status,
 		(status & STS_ASS) ? " Async" : "",
@@ -192,7 +192,7 @@ dbg_status_buf (char *buf, unsigned len, char *label, u32 status)
 static int __attribute__((__unused__))
 dbg_intr_buf (char *buf, unsigned len, char *label, u32 enable)
 {
-	return snprintf (buf, len,
+	return scnprintf (buf, len,
 		"%s%sintrenable %02x%s%s%s%s%s%s",
 		label, label [0] ? " " : "", enable,
 		(enable & STS_IAA) ? " IAA" : "",
@@ -209,7 +209,7 @@ static const char *const fls_strings [] =
 
 static int dbg_command_buf (char *buf, unsigned len, char *label, u32 command)
 {
-	return snprintf (buf, len,
+	return scnprintf (buf, len,
 		"%s%scommand %06x %s=%d ithresh=%d%s%s%s%s period=%s%s %s",
 		label, label [0] ? " " : "", command,
 		(command & CMD_PARK) ? "park" : "(park)",
@@ -238,7 +238,7 @@ dbg_port_buf (char *buf, unsigned len, char *label, int port, u32 status)
 	default: sig = "?"; break;
 	}
 
-	return snprintf (buf, len,
+	return scnprintf (buf, len,
 		"%s%sport %d status %06x%s%s sig=%s %s%s%s%s%s%s%s%s%s",
 		label, label [0] ? " " : "", port, status,
 		(status & PORT_POWER) ? " POWER" : "",
@@ -359,7 +359,7 @@ static void qh_lines (
 	}
 	scratch = cpu_to_le32p (&qh->hw_info1);
 	hw_curr = (mark == '*') ? cpu_to_le32p (&qh->hw_current) : 0;
-	temp = snprintf (next, size,
+	temp = scnprintf (next, size,
 			"qh/%p dev%d %cs ep%d %08x %08x (%08x%c %s nak%d)",
 			qh, scratch & 0x007f,
 			speed_char (scratch),
@@ -449,7 +449,7 @@ show_async (struct class_device *class_dev, char *buf)
 	for (qh = ehci->async->qh_next.qh; size > 0 && qh; qh = qh->qh_next.qh)
 		qh_lines (ehci, qh, &next, &size);
 	if (ehci->reclaim && size > 0) {
-		temp = snprintf (next, size, "\nreclaim =\n");
+		temp = scnprintf (next, size, "\nreclaim =\n");
 		size -= temp;
 		next += temp;
 
@@ -486,7 +486,7 @@ show_periodic (struct class_device *class_dev, char *buf)
 	next = buf;
 	size = PAGE_SIZE;
 
-	temp = snprintf (next, size, "size = %d\n", ehci->periodic_size);
+	temp = scnprintf (next, size, "size = %d\n", ehci->periodic_size);
 	size -= temp;
 	next += temp;
 
@@ -500,14 +500,14 @@ show_periodic (struct class_device *class_dev, char *buf)
 			continue;
 		tag = Q_NEXT_TYPE (ehci->periodic [i]);
 
-		temp = snprintf (next, size, "%4d: ", i);
+		temp = scnprintf (next, size, "%4d: ", i);
 		size -= temp;
 		next += temp;
 
 		do {
 			switch (tag) {
 			case Q_TYPE_QH:
-				temp = snprintf (next, size, " qh%d-%04x/%p",
+				temp = scnprintf (next, size, " qh%d-%04x/%p",
 						p.qh->period,
 						le32_to_cpup (&p.qh->hw_info2)
 							/* uframe masks */
@@ -520,7 +520,7 @@ show_periodic (struct class_device *class_dev, char *buf)
 					if (seen [temp].ptr != p.ptr)
 						continue;
 					if (p.qh->qh_next.ptr)
-						temp = snprintf (next, size,
+						temp = scnprintf (next, size,
 							" ...");
 					p.ptr = 0;
 					break;
@@ -545,7 +545,7 @@ show_periodic (struct class_device *class_dev, char *buf)
 						}
 					}
 
-					temp = snprintf (next, size,
+					temp = scnprintf (next, size,
 						" (%c%d ep%d%s "
 						"[%d/%d] q%d p%d)",
 						speed_char (scratch),
@@ -565,20 +565,20 @@ show_periodic (struct class_device *class_dev, char *buf)
 				}
 				break;
 			case Q_TYPE_FSTN:
-				temp = snprintf (next, size,
+				temp = scnprintf (next, size,
 					" fstn-%8x/%p", p.fstn->hw_prev,
 					p.fstn);
 				tag = Q_NEXT_TYPE (p.fstn->hw_next);
 				p = p.fstn->fstn_next;
 				break;
 			case Q_TYPE_ITD:
-				temp = snprintf (next, size,
+				temp = scnprintf (next, size,
 					" itd/%p", p.itd);
 				tag = Q_NEXT_TYPE (p.itd->hw_next);
 				p = p.itd->itd_next;
 				break;
 			case Q_TYPE_SITD:
-				temp = snprintf (next, size,
+				temp = scnprintf (next, size,
 					" sitd/%p", p.sitd);
 				tag = Q_NEXT_TYPE (p.sitd->hw_next);
 				p = p.sitd->sitd_next;
@@ -588,7 +588,7 @@ show_periodic (struct class_device *class_dev, char *buf)
 			next += temp;
 		} while (p.ptr);
 
-		temp = snprintf (next, size, "\n");
+		temp = scnprintf (next, size, "\n");
 		size -= temp;
 		next += temp;
 	}
@@ -623,7 +623,7 @@ show_registers (struct class_device *class_dev, char *buf)
 
 	/* Capability Registers */
 	i = HC_VERSION(readl (&ehci->caps->hc_capbase));
-	temp = snprintf (next, size,
+	temp = scnprintf (next, size,
 		"PCI device %s\nEHCI %x.%02x, hcd state %d (driver " DRIVER_VERSION ")\n",
 		pci_name(hcd->pdev),
 		i >> 8, i & 0x0ff, ehci->hcd.state);
@@ -632,35 +632,35 @@ show_registers (struct class_device *class_dev, char *buf)
 
 	// FIXME interpret both types of params
 	i = readl (&ehci->caps->hcs_params);
-	temp = snprintf (next, size, "structural params 0x%08x\n", i);
+	temp = scnprintf (next, size, "structural params 0x%08x\n", i);
 	size -= temp;
 	next += temp;
 
 	i = readl (&ehci->caps->hcc_params);
-	temp = snprintf (next, size, "capability params 0x%08x\n", i);
+	temp = scnprintf (next, size, "capability params 0x%08x\n", i);
 	size -= temp;
 	next += temp;
 
 	/* Operational Registers */
 	temp = dbg_status_buf (scratch, sizeof scratch, label,
 			readl (&ehci->regs->status));
-	temp = snprintf (next, size, fmt, temp, scratch);
+	temp = scnprintf (next, size, fmt, temp, scratch);
 	size -= temp;
 	next += temp;
 
 	temp = dbg_command_buf (scratch, sizeof scratch, label,
 			readl (&ehci->regs->command));
-	temp = snprintf (next, size, fmt, temp, scratch);
+	temp = scnprintf (next, size, fmt, temp, scratch);
 	size -= temp;
 	next += temp;
 
 	temp = dbg_intr_buf (scratch, sizeof scratch, label,
 			readl (&ehci->regs->intr_enable));
-	temp = snprintf (next, size, fmt, temp, scratch);
+	temp = scnprintf (next, size, fmt, temp, scratch);
 	size -= temp;
 	next += temp;
 
-	temp = snprintf (next, size, "uframe %04x\n",
+	temp = scnprintf (next, size, "uframe %04x\n",
 			readl (&ehci->regs->frame_index));
 	size -= temp;
 	next += temp;
@@ -668,13 +668,13 @@ show_registers (struct class_device *class_dev, char *buf)
 	for (i = 0; i < HCS_N_PORTS (ehci->hcs_params); i++) {
 		temp = dbg_port_buf (scratch, sizeof scratch, label, i,
 				readl (&ehci->regs->port_status [i]));
-		temp = snprintf (next, size, fmt, temp, scratch);
+		temp = scnprintf (next, size, fmt, temp, scratch);
 		size -= temp;
 		next += temp;
 	}
 
 	if (ehci->reclaim) {
-		temp = snprintf (next, size, "reclaim qh %p%s\n",
+		temp = scnprintf (next, size, "reclaim qh %p%s\n",
 				ehci->reclaim,
 				ehci->reclaim_ready ? " ready" : "");
 		size -= temp;
@@ -682,14 +682,14 @@ show_registers (struct class_device *class_dev, char *buf)
 	}
 
 #ifdef EHCI_STATS
-	temp = snprintf (next, size,
+	temp = scnprintf (next, size,
 		"irq normal %ld err %ld reclaim %ld (lost %ld)\n",
 		ehci->stats.normal, ehci->stats.error, ehci->stats.reclaim,
 		ehci->stats.lost_iaa);
 	size -= temp;
 	next += temp;
 
-	temp = snprintf (next, size, "complete %ld unlink %ld\n",
+	temp = scnprintf (next, size, "complete %ld unlink %ld\n",
 		ehci->stats.complete, ehci->stats.unlink);
 	size -= temp;
 	next += temp;

drivers/usb/host/ohci-dbg.c

@@ -76,7 +76,7 @@ urb_print (struct urb * urb, char * str, int small)
 	do { \
 	if (next) { \
 		unsigned s_len; \
-		s_len = snprintf (*next, *size, format, ## arg ); \
+		s_len = scnprintf (*next, *size, format, ## arg ); \
 		*size -= s_len; *next += s_len; \
 	} else \
 		ohci_dbg(ohci,format, ## arg ); \
@@ -420,7 +420,7 @@ show_list (struct ohci_hcd *ohci, char *buf, size_t count, struct ed *ed)
 		struct list_head	*entry;
 		struct td		*td;
 
-		temp = snprintf (buf, size,
+		temp = scnprintf (buf, size,
 			"ed/%p %cs dev%d ep%d%s max %d %08x%s%s %s",
 			ed,
 			(info & ED_LOWSPEED) ? 'l' : 'f',
@@ -442,7 +442,7 @@ show_list (struct ohci_hcd *ohci, char *buf, size_t count, struct ed *ed)
 			scratch = cpu_to_le32p (&td->hwINFO);
 			cbp = le32_to_cpup (&td->hwCBP);
 			be = le32_to_cpup (&td->hwBE);
-			temp = snprintf (buf, size,
+			temp = scnprintf (buf, size,
 					"\n\ttd %p %s %d cc=%x urb %p (%08x)",
 					td,
 					({ char *pid;
@@ -458,7 +458,7 @@ show_list (struct ohci_hcd *ohci, char *buf, size_t count, struct ed *ed)
 			buf += temp;
 		}
 
-		temp = snprintf (buf, size, "\n");
+		temp = scnprintf (buf, size, "\n");
 		size -= temp;
 		buf += temp;
 
@@ -515,7 +515,7 @@ show_periodic (struct class_device *class_dev, char *buf)
 	next = buf;
 	size = PAGE_SIZE;
 
-	temp = snprintf (next, size, "size = %d\n", NUM_INTS);
+	temp = scnprintf (next, size, "size = %d\n", NUM_INTS);
 	size -= temp;
 	next += temp;
 
@@ -525,12 +525,12 @@ show_periodic (struct class_device *class_dev, char *buf)
 		if (!(ed = ohci->periodic [i]))
 			continue;
 
-		temp = snprintf (next, size, "%2d [%3d]:", i, ohci->load [i]);
+		temp = scnprintf (next, size, "%2d [%3d]:", i, ohci->load [i]);
 		size -= temp;
 		next += temp;
 
 		do {
-			temp = snprintf (next, size, " ed%d/%p",
+			temp = scnprintf (next, size, " ed%d/%p",
 				ed->interval, ed);
 			size -= temp;
 			next += temp;
@@ -550,7 +550,7 @@ show_periodic (struct class_device *class_dev, char *buf)
 				list_for_each (entry, &ed->td_list)
 					qlen++;
 
-				temp = snprintf (next, size,
+				temp = scnprintf (next, size,
 					" (%cs dev%d ep%d%s-%s qlen %u"
 					" max %d %08x%s%s)",
 					(info & ED_LOWSPEED) ? 'l' : 'f',
@@ -579,7 +579,7 @@ show_periodic (struct class_device *class_dev, char *buf)
 
 		} while (ed);
 
-		temp = snprintf (next, size, "\n");
+		temp = scnprintf (next, size, "\n");
 		size -= temp;
 		next += temp;
 	}
@@ -628,7 +628,7 @@ show_registers (struct class_device *class_dev, char *buf)
 
 	/* other registers mostly affect frame timings */
 	rdata = readl (&regs->fminterval);
-	temp = snprintf (next, size,
+	temp = scnprintf (next, size,
 			"fmintvl 0x%08x %sFSMPS=0x%04x FI=0x%04x\n",
 			rdata, (rdata >> 31) ? " FIT" : "",
 			(rdata >> 16) & 0xefff, rdata & 0xffff);
@@ -636,20 +636,20 @@ show_registers (struct class_device *class_dev, char *buf)
 	next += temp;
 
 	rdata = readl (&regs->fmremaining);
-	temp = snprintf (next, size, "fmremaining 0x%08x %sFR=0x%04x\n",
+	temp = scnprintf (next, size, "fmremaining 0x%08x %sFR=0x%04x\n",
 			rdata, (rdata >> 31) ? " FRT" : "",
 			rdata & 0x3fff);
 	size -= temp;
 	next += temp;
 
 	rdata = readl (&regs->periodicstart);
-	temp = snprintf (next, size, "periodicstart 0x%04x\n",
+	temp = scnprintf (next, size, "periodicstart 0x%04x\n",
 			rdata & 0x3fff);
 	size -= temp;
 	next += temp;
 
 	rdata = readl (&regs->lsthresh);
-	temp = snprintf (next, size, "lsthresh 0x%04x\n",
+	temp = scnprintf (next, size, "lsthresh 0x%04x\n",
 			rdata & 0x3fff);
 	size -= temp;
 	next += temp;

drivers/usb/misc/speedtch.c

@@ -1161,7 +1161,7 @@ static int udsl_usb_probe (struct usb_interface *intf, const struct usb_device_i
 	buf += i;
 	length -= i;
 
-	i = snprintf (buf, length, " (");
+	i = scnprintf (buf, length, " (");
 	buf += i;
 	length -= i;
 

include/linux/kernel.h

@@ -72,6 +72,9 @@ extern int vsprintf(char *buf, const char *, va_list);
 extern int snprintf(char * buf, size_t size, const char * fmt, ...)
 	__attribute__ ((format (printf, 3, 4)));
 extern int vsnprintf(char *buf, size_t size, const char *fmt, va_list args);
+extern int scnprintf(char * buf, size_t size, const char * fmt, ...)
+	__attribute__ ((format (printf, 3, 4)));
+extern int vscnprintf(char *buf, size_t size, const char *fmt, va_list args);
 
 extern int sscanf(const char *, const char *, ...)
 	__attribute__ ((format (scanf,2,3)));

kernel/printk.c

@@ -501,7 +501,7 @@ asmlinkage int printk(const char *fmt, ...)
 
 	/* Emit the output into the temporary buffer */
 	va_start(args, fmt);
-	printed_len = vsnprintf(printk_buf, sizeof(printk_buf), fmt, args);
+	printed_len = vscnprintf(printk_buf, sizeof(printk_buf), fmt, args);
 	va_end(args);
 
 	/*

lib/bitmap.c

@@ -193,7 +193,7 @@ int bitmap_snprintf(char *buf, unsigned int buflen,
 		word = i / BITS_PER_LONG;
 		bit = i % BITS_PER_LONG;
 		val = (maskp[word] >> bit) & chunkmask;
-		len += snprintf(buf+len, buflen-len, "%s%0*lx", sep,
+		len += scnprintf(buf+len, buflen-len, "%s%0*lx", sep,
 			(chunksz+3)/4, val);
 		chunksz = CHUNKSZ;
 		sep = ",";

lib/vsprintf.c

@@ -12,6 +12,8 @@
 /* 
  * Fri Jul 13 2001 Crutcher Dunnavant <crutcher+kernel@datastacks.com>
  * - changed to provide snprintf and vsnprintf functions
+ * So Feb  1 16:51:32 CET 2004 Juergen Quade <quade@hsnr.de>
+ * - scnprintf and vscnprintf
  */
 
 #include <stdarg.h>
@@ -228,19 +230,22 @@ static char * number(char * buf, char * end, unsigned long long num, int base, i
 }
 
 /**
-* vsnprintf - Format a string and place it in a buffer
-* @buf: The buffer to place the result into
-* @size: The size of the buffer, including the trailing null space
-* @fmt: The format string to use
-* @args: Arguments for the format string
-*
-* The return value is the number of characters which would be
-* generated for the given input, excluding the trailing null,
-* as per ISO C99.  If the return is greater than or equal to
-* @size, the resulting string is truncated.
-*
-* Call this function if you are already dealing with a va_list.
-* You probably want snprintf instead.
+ * vsnprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @size: The size of the buffer, including the trailing null space
+ * @fmt: The format string to use
+ * @args: Arguments for the format string
+ *
+ * The return value is the number of characters which would
+ * be generated for the given input, excluding the trailing
+ * '\0', as per ISO C99. If you want to have the exact
+ * number of characters written into @buf as return value
+ * (not including the trailing '\0'), use vscnprintf. If the
+ * return is greater than or equal to @size, the resulting
+ * string is truncated.
+ *
+ * Call this function if you are already dealing with a va_list.
+ * You probably want snprintf instead.
  */
 int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
 {
@@ -481,6 +486,30 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
 
 EXPORT_SYMBOL(vsnprintf);
 
+/**
+ * vscnprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @size: The size of the buffer, including the trailing null space
+ * @fmt: The format string to use
+ * @args: Arguments for the format string
+ *
+ * The return value is the number of characters which have been written into
+ * the @buf not including the trailing '\0'. If @size is <= 0 the function
+ * returns 0.
+ *
+ * Call this function if you are already dealing with a va_list.
+ * You probably want scnprintf instead.
+ */
+int vscnprintf(char *buf, size_t size, const char *fmt, va_list args)
+{
+	int i;
+
+	i=vsnprintf(buf,size,fmt,args);
+	return (i >= size) ? (size - 1) : i;
+}
+
+EXPORT_SYMBOL(vscnprintf);
+
 /**
  * snprintf - Format a string and place it in a buffer
  * @buf: The buffer to place the result into
@@ -506,12 +535,40 @@ int snprintf(char * buf, size_t size, const char *fmt, ...)
 
 EXPORT_SYMBOL(snprintf);
 
+/**
+ * scnprintf - Format a string and place it in a buffer
+ * @buf: The buffer to place the result into
+ * @size: The size of the buffer, including the trailing null space
+ * @fmt: The format string to use
+ * @...: Arguments for the format string
+ *
+ * The return value is the number of characters written into @buf not including
+ * the trailing '\0'. If @size is <= 0 the function returns 0. If the return is
+ * greater than or equal to @size, the resulting string is truncated.
+ */
+
+int scnprintf(char * buf, size_t size, const char *fmt, ...)
+{
+	va_list args;
+	int i;
+
+	va_start(args, fmt);
+	i = vsnprintf(buf, size, fmt, args);
+	va_end(args);
+	return (i >= size) ? (size - 1) : i;
+}
+EXPORT_SYMBOL(scnprintf);
+
 /**
  * vsprintf - Format a string and place it in a buffer
  * @buf: The buffer to place the result into
  * @fmt: The format string to use
  * @args: Arguments for the format string
  *
+ * The function returns the number of characters written
+ * into @buf. Use vsnprintf or vscnprintf in order to avoid
+ * buffer overflows.
+ *
  * Call this function if you are already dealing with a va_list.
  * You probably want sprintf instead.
  */
@@ -527,6 +584,10 @@ EXPORT_SYMBOL(vsprintf);
  * @buf: The buffer to place the result into
  * @fmt: The format string to use
  * @...: Arguments for the format string
+ *
+ * The function returns the number of characters written
+ * into @buf. Use snprintf or scnprintf in order to avoid
+ * buffer overflows.
  */
 int sprintf(char * buf, const char *fmt, ...)
 {

net/atm/clip.c

@@ -829,7 +829,7 @@ static void atmarp_info(struct seq_file *seq, struct net_device *dev,
 	    !clip_vcc || clip_vcc->encap ? "LLC" : "NULL",
 	    (jiffies-(clip_vcc ? clip_vcc->last_use : entry->neigh->used))/HZ);
 
-	off = snprintf(buf, sizeof(buf) - 1, "%d.%d.%d.%d", NIPQUAD(entry->ip));
+	off = scnprintf(buf, sizeof(buf) - 1, "%d.%d.%d.%d", NIPQUAD(entry->ip));
 	while (off < 16)
 		buf[off++] = ' ';
 	buf[off] = '\0';

security/selinux/selinuxfs.c

@@ -56,7 +56,7 @@ static ssize_t sel_read_enforce(struct file *filp, char *buf,
 		return -ENOMEM;
 	memset(page, 0, PAGE_SIZE);
 
-	length = snprintf(page, PAGE_SIZE, "%d", selinux_enforcing);
+	length = scnprintf(page, PAGE_SIZE, "%d", selinux_enforcing);
 	if (length < 0) {
 		free_page((unsigned long)page);
 		return length;
@@ -142,7 +142,7 @@ static ssize_t sel_read_policyvers(struct file *filp, char *buf,
 		return -ENOMEM;
 	memset(page, 0, PAGE_SIZE);
 
-	length = snprintf(page, PAGE_SIZE, "%u", POLICYDB_VERSION);
+	length = scnprintf(page, PAGE_SIZE, "%u", POLICYDB_VERSION);
 	if (length < 0) {
 		free_page((unsigned long)page);
 		return length;
@@ -407,7 +407,7 @@ static ssize_t sel_write_access(struct file * file, char *buf, size_t size)
 	if (length < 0)
 		goto out2;
 
-	length = snprintf(buf, PAYLOAD_SIZE, "%x %x %x %x %u",
+	length = scnprintf(buf, PAYLOAD_SIZE, "%x %x %x %x %u",
 			  avd.allowed, avd.decided,
 			  avd.auditallow, avd.auditdeny,
 			  avd.seqno);

sound/core/info.c

@@ -99,7 +99,7 @@ int snd_iprintf(snd_info_buffer_t * buffer, char *fmt,...)
 	if (buffer->stop || buffer->error)
 		return 0;
 	va_start(args, fmt);
-	res = vsnprintf(sbuffer, sizeof(sbuffer), fmt, args);
+	res = vscnprintf(sbuffer, sizeof(sbuffer), fmt, args);
 	va_end(args);
 	if (buffer->size + res >= buffer->len) {
 		buffer->stop = 1;