diff options
| author | Dan Carpenter <dan.carpenter@oracle.com> | 2015-04-09 11:05:04 +0200 |
|---|---|---|
| committer | Vinod Koul <vinod.koul@intel.com> | 2015-04-17 20:04:51 +0200 |
| commit | ed1f041842f0c4226a78fcd96ccb8e6a5433ae9d (patch) | |
| tree | 39d1f23b90f566646ce8a4f4c4f30358cab6cd39 /drivers/dma/xgene-dma.c | |
| parent | dmaengine: usb-dmac: Fix dereferencing freed memory 'desc' (diff) | |
| download | linux-ed1f041842f0c4226a78fcd96ccb8e6a5433ae9d.tar.xz linux-ed1f041842f0c4226a78fcd96ccb8e6a5433ae9d.zip | |
dmaengine: xgene: buffer overflow in xgene_dma_init_channels()
We put 9 characters into the 8 character name[] array. Let's make the
array bigger and change the sprintf() to snprintf().
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Vinod Koul <vinod.koul@intel.com>
Diffstat (limited to 'drivers/dma/xgene-dma.c')
| -rwxr-xr-x | drivers/dma/xgene-dma.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/dma/xgene-dma.c b/drivers/dma/xgene-dma.c index aa61935ee706..06d40427aa08 100755 --- a/drivers/dma/xgene-dma.c +++ b/drivers/dma/xgene-dma.c @@ -314,7 +314,7 @@ struct xgene_dma_chan { struct device *dev; int id; int rx_irq; - char name[8]; + char name[10]; spinlock_t lock; int pending; int max_outstanding; @@ -1876,7 +1876,7 @@ static void xgene_dma_init_channels(struct xgene_dma *pdma) chan->dev = pdma->dev; chan->pdma = pdma; chan->id = i; - sprintf(chan->name, "dmachan%d", chan->id); + snprintf(chan->name, sizeof(chan->name), "dmachan%d", chan->id); } } |