From 0b0652737381e839a2d55c892bf9e4f1d86db21b Mon Sep 17 00:00:00 2001 From: Michael Walle Date: Wed, 3 Apr 2024 16:31:55 +0200 Subject: [PATCH] net: ti: am65-cpsw: Fix buffer overflow The device name is a concatenation of the device node name of the cpsw device and of the device node name of the port. In my case that is ethernet@8000000 port@1 First the buffer is really too small, but more importantly, there is no boundary check. Use snprintf() and increase the buffer size. Fixes: 38922b1f4acc ("net: ti: am65-cpsw: Add support for multi port independent MAC mode") Signed-off-by: Michael Walle --- drivers/net/ti/am65-cpsw-nuss.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/net/ti/am65-cpsw-nuss.c b/drivers/net/ti/am65-cpsw-nuss.c index d68ed67183..b151e25d6a 100644 --- a/drivers/net/ti/am65-cpsw-nuss.c +++ b/drivers/net/ti/am65-cpsw-nuss.c @@ -664,7 +664,7 @@ static int am65_cpsw_port_probe(struct udevice *dev) struct am65_cpsw_priv *priv = dev_get_priv(dev); struct eth_pdata *pdata = dev_get_plat(dev); struct am65_cpsw_common *cpsw_common; - char portname[15]; + char portname[32]; int ret; priv->dev = dev; @@ -672,7 +672,7 @@ static int am65_cpsw_port_probe(struct udevice *dev) cpsw_common = dev_get_priv(dev->parent); priv->cpsw_common = cpsw_common; - sprintf(portname, "%s%s", dev->parent->name, dev->name); + snprintf(portname, sizeof(portname), "%s%s", dev->parent->name, dev->name); device_set_name(dev, portname); ret = am65_cpsw_ofdata_parse_phy(dev); -- 2.39.5