From b192b42a70393c5194acf48c65d320c824f1d261 Mon Sep 17 00:00:00 2001 From: Arnd Bergmann Date: Mon, 17 Jul 2017 14:00:00 +0200 Subject: scsi: fusion: fix string overflow warning gcc points out a theorerical string overflow: drivers/message/fusion/mptbase.c: In function 'mpt_detach': drivers/message/fusion/mptbase.c:2103:17: error: '%s' directive writing up to 31 bytes into a region of size 28 [-Werror=format-overflow=] sprintf(pname, MPT_PROCFS_MPTBASEDIR "/%s/summary", ioc->name); ^~~~~ drivers/message/fusion/mptbase.c:2103:2: note: 'sprintf' output between 13 and 44 bytes into a destination of size 32 We can simply double the size of the local buffer here to be on the safe side, and using snprintf() instead of sprintf() protects us if ioc->name was not terminated properly. Signed-off-by: Arnd Bergmann Signed-off-by: Martin K. Petersen --- drivers/message/fusion/mptbase.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) (limited to 'drivers/message') diff --git a/drivers/message/fusion/mptbase.c b/drivers/message/fusion/mptbase.c index 62cff5afc6bd..84eab28665f3 100644 --- a/drivers/message/fusion/mptbase.c +++ b/drivers/message/fusion/mptbase.c @@ -2079,7 +2079,7 @@ void mpt_detach(struct pci_dev *pdev) { MPT_ADAPTER *ioc = pci_get_drvdata(pdev); - char pname[32]; + char pname[64]; u8 cb_idx; unsigned long flags; struct workqueue_struct *wq; @@ -2100,11 +2100,11 @@ mpt_detach(struct pci_dev *pdev) spin_unlock_irqrestore(&ioc->fw_event_lock, flags); destroy_workqueue(wq); - sprintf(pname, MPT_PROCFS_MPTBASEDIR "/%s/summary", ioc->name); + snprintf(pname, sizeof(pname), MPT_PROCFS_MPTBASEDIR "/%s/summary", ioc->name); remove_proc_entry(pname, NULL); - sprintf(pname, MPT_PROCFS_MPTBASEDIR "/%s/info", ioc->name); + snprintf(pname, sizeof(pname), MPT_PROCFS_MPTBASEDIR "/%s/info", ioc->name); remove_proc_entry(pname, NULL); - sprintf(pname, MPT_PROCFS_MPTBASEDIR "/%s", ioc->name); + snprintf(pname, sizeof(pname), MPT_PROCFS_MPTBASEDIR "/%s", ioc->name); remove_proc_entry(pname, NULL); /* call per device driver remove entry point */ -- cgit v1.2.3