From: Michael Walle <mwalle@kernel.org>
Date: Wed, 3 Apr 2024 14:31:55 +0000 (+0200)
Subject: net: ti: am65-cpsw: Fix buffer overflow
X-Git-Url: http://git.dujemihanovic.xyz/img/static/git-favicon.png?a=commitdiff_plain;h=0b0652737381e839a2d55c892bf9e4f1d86db21b;p=u-boot.git

net: ti: am65-cpsw: Fix buffer overflow

The device name is a concatenation of the device node name of the cpsw
device and of the device node name of the port. In my case that is

  ethernet@8000000
  port@1

First the buffer is really too small, but more importantly, there is no
boundary check. Use snprintf() and increase the buffer size.

Fixes: 38922b1f4acc ("net: ti: am65-cpsw: Add support for multi port independent MAC mode")
Signed-off-by: Michael Walle <mwalle@kernel.org>
---

diff --git a/drivers/net/ti/am65-cpsw-nuss.c b/drivers/net/ti/am65-cpsw-nuss.c
index d68ed67183..b151e25d6a 100644
--- a/drivers/net/ti/am65-cpsw-nuss.c
+++ b/drivers/net/ti/am65-cpsw-nuss.c
@@ -664,7 +664,7 @@ static int am65_cpsw_port_probe(struct udevice *dev)
 	struct am65_cpsw_priv *priv = dev_get_priv(dev);
 	struct eth_pdata *pdata = dev_get_plat(dev);
 	struct am65_cpsw_common *cpsw_common;
-	char portname[15];
+	char portname[32];
 	int ret;
 
 	priv->dev = dev;
@@ -672,7 +672,7 @@ static int am65_cpsw_port_probe(struct udevice *dev)
 	cpsw_common = dev_get_priv(dev->parent);
 	priv->cpsw_common = cpsw_common;
 
-	sprintf(portname, "%s%s", dev->parent->name, dev->name);
+	snprintf(portname, sizeof(portname), "%s%s", dev->parent->name, dev->name);
 	device_set_name(dev, portname);
 
 	ret = am65_cpsw_ofdata_parse_phy(dev);