linux-usb.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
* [PATCH 1/5] usb: mtu3: fix coverity of string buffer
@ 2022-07-08  7:18 Chunfeng Yun
  2022-07-08  7:19 ` [PATCH 2/5] usb: mtu3: print endpoint type as string Chunfeng Yun
                   ` (4 more replies)
  0 siblings, 5 replies; 9+ messages in thread
From: Chunfeng Yun @ 2022-07-08  7:18 UTC (permalink / raw)
  To: Greg Kroah-Hartman
  Cc: Chunfeng Yun, Matthias Brugger, linux-usb, linux-arm-kernel,
	linux-mediatek, linux-kernel, Felipe Balbi, Eddie Hung

Use snprintf instead of sprintf which could cause buffer overflow.

Signed-off-by: Chunfeng Yun <chunfeng.yun@mediatek.com>
---
 drivers/usb/mtu3/mtu3.h         | 4 +++-
 drivers/usb/mtu3/mtu3_debugfs.c | 2 +-
 drivers/usb/mtu3/mtu3_gadget.c  | 4 ++--
 3 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/mtu3/mtu3.h b/drivers/usb/mtu3/mtu3.h
index 8408e1b1a24a..9893dd1bafbb 100644
--- a/drivers/usb/mtu3/mtu3.h
+++ b/drivers/usb/mtu3/mtu3.h
@@ -92,6 +92,8 @@ struct mtu3_request;
 
 #define BULK_CLKS_CNT	4
 
+#define MTU3_EP_NAME_LEN	12
+
 /* device operated link and speed got from DEVICE_CONF register */
 enum mtu3_speed {
 	MTU3_SPEED_INACTIVE = 0,
@@ -272,7 +274,7 @@ struct ssusb_mtk {
  */
 struct mtu3_ep {
 	struct usb_ep ep;
-	char name[12];
+	char name[MTU3_EP_NAME_LEN];
 	struct mtu3 *mtu;
 	u8 epnum;
 	u8 type;
diff --git a/drivers/usb/mtu3/mtu3_debugfs.c b/drivers/usb/mtu3/mtu3_debugfs.c
index d27de647c86a..a6f72494b819 100644
--- a/drivers/usb/mtu3/mtu3_debugfs.c
+++ b/drivers/usb/mtu3/mtu3_debugfs.c
@@ -132,7 +132,7 @@ static void mtu3_debugfs_regset(struct mtu3 *mtu, void __iomem *base,
 	if (!mregs)
 		return;
 
-	sprintf(mregs->name, "%s", name);
+	snprintf(mregs->name, MTU3_DEBUGFS_NAME_LEN, "%s", name);
 	regset = &mregs->regset;
 	regset->regs = regs;
 	regset->nregs = nregs;
diff --git a/drivers/usb/mtu3/mtu3_gadget.c b/drivers/usb/mtu3/mtu3_gadget.c
index 30999b4debb8..a751e0533c2d 100644
--- a/drivers/usb/mtu3/mtu3_gadget.c
+++ b/drivers/usb/mtu3/mtu3_gadget.c
@@ -635,8 +635,8 @@ static void init_hw_ep(struct mtu3 *mtu, struct mtu3_ep *mep,
 
 	INIT_LIST_HEAD(&mep->req_list);
 
-	sprintf(mep->name, "ep%d%s", epnum,
-		!epnum ? "" : (is_in ? "in" : "out"));
+	snprintf(mep->name, MTU3_EP_NAME_LEN, "ep%d%s", epnum,
+		 !epnum ? "" : (is_in ? "in" : "out"));
 
 	mep->ep.name = mep->name;
 	INIT_LIST_HEAD(&mep->ep.ep_list);
-- 
2.18.0


^ permalink raw reply related	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2022-07-13  9:42 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2022-07-08  7:18 [PATCH 1/5] usb: mtu3: fix coverity of string buffer Chunfeng Yun
2022-07-08  7:19 ` [PATCH 2/5] usb: mtu3: print endpoint type as string Chunfeng Yun
2022-07-08  7:19 ` [PATCH 3/5] usb: mtu3: add feature to disable device's usb3 port Chunfeng Yun
2022-07-08  7:19 ` [PATCH 4/5] usb: mtu3: check capability of usb3 dual role Chunfeng Yun
2022-07-08  7:19 ` [PATCH 5/5] usb: mtu3: support function remote wakeup Chunfeng Yun
2022-07-08  7:26 ` [PATCH 1/5] usb: mtu3: fix coverity of string buffer Greg Kroah-Hartman
2022-07-11  6:39   ` Chunfeng Yun
2022-07-11  6:45     ` Greg Kroah-Hartman
2022-07-13  9:42       ` Chunfeng Yun

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).