From: Stefan Wiehler The "mcs%d" name is built with the unbounded sprintf(), which writes without any regard for the size of the destination buffer and can overrun it. Switch to snprintf() with sizeof() so the formatted write is always clamped to the buffer. The buffer is also enlarged to 24 bytes to comfortably hold the string for any MCS block index. Fixes: d06c2aba5163 ("octeontx2-af: cn10k: mcs: Add debugfs support"). Signed-off-by: Stefan Wiehler Signed-off-by: Subrat Pandey --- drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c index 3456313d3b3c..a13848f26ae9 100644 --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c @@ -497,7 +497,7 @@ RVU_DEBUG_SEQ_FOPS(mcs_rx_secy_stats, mcs_rx_secy_stats_display, NULL); static void rvu_dbg_mcs_init(struct rvu *rvu) { struct mcs *mcs; - char dname[10]; + char dname[24]; int i; if (!rvu->mcs_blk_cnt) @@ -508,7 +508,7 @@ static void rvu_dbg_mcs_init(struct rvu *rvu) for (i = 0; i < rvu->mcs_blk_cnt; i++) { mcs = mcs_get_pdata(i); - sprintf(dname, "mcs%d", i); + snprintf(dname, sizeof(dname), "mcs%d", i); rvu->rvu_dbg.mcs = debugfs_create_dir(dname, rvu->rvu_dbg.mcs_root); -- 2.43.0