[PATCH] net: ti: am65-cpsw: Fix buffer overflow

Michael Walle mwalle at kernel.org
Wed Apr 3 16:31:55 CEST 2024


The device name is a concatenation of the device node name of the cpsw
device and of the device node name of the port. In my case that is

  ethernet at 8000000
  port at 1

First the buffer is really too small, but more importantly, there is no
boundary check. Use snprintf() and increase the buffer size.

Fixes: 38922b1f4acc ("net: ti: am65-cpsw: Add support for multi port independent MAC mode")
Signed-off-by: Michael Walle <mwalle at kernel.org>
---
 drivers/net/ti/am65-cpsw-nuss.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ti/am65-cpsw-nuss.c b/drivers/net/ti/am65-cpsw-nuss.c
index d68ed671836..b151e25d6a4 100644
--- a/drivers/net/ti/am65-cpsw-nuss.c
+++ b/drivers/net/ti/am65-cpsw-nuss.c
@@ -664,7 +664,7 @@ static int am65_cpsw_port_probe(struct udevice *dev)
 	struct am65_cpsw_priv *priv = dev_get_priv(dev);
 	struct eth_pdata *pdata = dev_get_plat(dev);
 	struct am65_cpsw_common *cpsw_common;
-	char portname[15];
+	char portname[32];
 	int ret;
 
 	priv->dev = dev;
@@ -672,7 +672,7 @@ static int am65_cpsw_port_probe(struct udevice *dev)
 	cpsw_common = dev_get_priv(dev->parent);
 	priv->cpsw_common = cpsw_common;
 
-	sprintf(portname, "%s%s", dev->parent->name, dev->name);
+	snprintf(portname, sizeof(portname), "%s%s", dev->parent->name, dev->name);
 	device_set_name(dev, portname);
 
 	ret = am65_cpsw_ofdata_parse_phy(dev);
-- 
2.39.2



More information about the U-Boot mailing list