diff mbox

[1/2] dmaengine: xgene: buffer overflow in xgene_dma_init_channels()

Message ID 20150409090503.GD17605@mwanda (mailing list archive)
State Accepted
Headers show

Commit Message

Dan Carpenter April 9, 2015, 9:05 a.m. UTC
We put 9 characters into the 8 character name[] array.  Let's make the
array bigger and change the sprintf() to snprintf().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>

--
To unsubscribe from this list: send the line "unsubscribe dmaengine" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Vinod Koul April 17, 2015, 6:05 p.m. UTC | #1
On Thu, Apr 09, 2015 at 12:05:04PM +0300, Dan Carpenter wrote:
> We put 9 characters into the 8 character name[] array.  Let's make the
> array bigger and change the sprintf() to snprintf().
> 
Applied, both

Thanks
diff mbox

Patch

diff --git a/drivers/dma/xgene-dma.c b/drivers/dma/xgene-dma.c
index aa61935..06d4042 100755
--- a/drivers/dma/xgene-dma.c
+++ b/drivers/dma/xgene-dma.c
@@ -314,7 +314,7 @@  struct xgene_dma_chan {
 	struct device *dev;
 	int id;
 	int rx_irq;
-	char name[8];
+	char name[10];
 	spinlock_t lock;
 	int pending;
 	int max_outstanding;
@@ -1876,7 +1876,7 @@  static void xgene_dma_init_channels(struct xgene_dma *pdma)
 		chan->dev = pdma->dev;
 		chan->pdma = pdma;
 		chan->id = i;
-		sprintf(chan->name, "dmachan%d", chan->id);
+		snprintf(chan->name, sizeof(chan->name), "dmachan%d", chan->id);
 	}
 }