[PATCH] net: ti: icssg: Fix portname buffer overflow

[Jerome Forissier]

On 09/05/2026 22:01, Francois Berder wrote:
> portname consists of dev->parent->name ("icssg0-eth",
> "icssg1-eth", or "ethernet") and dev->name is the port node
> name ("port at 0" or "port at 1").  Every board DTS in the repository
> produces a string that overflows the buffer:
> 
> "icssg1-eth-port at 0"  17 chars + NUL = 18 bytes  (AM642 EVM, IoT2050)
> "ethernet-port at 0"    15 chars + NUL = 16 bytes  (SR-SOM, phyboard)
> 
> This commits increases portname to 64 bytes and replaces sprintf
> by snprintf so that any future DT node name cannot overflow it
> regardless of length.
> 
> Signed-off-by: Francois Berder <fberder at outlook.fr>
> ---
>  drivers/net/ti/icssg_prueth.c | 5 +++--
>  1 file changed, 3 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/ti/icssg_prueth.c b/drivers/net/ti/icssg_prueth.c
> index 12a162b9d68..4796d0d67cd 100644
> --- a/drivers/net/ti/icssg_prueth.c
> +++ b/drivers/net/ti/icssg_prueth.c
> @@ -496,14 +496,15 @@ static int prueth_port_probe(struct udevice *dev)
>  {
>  	struct prueth_priv *priv = dev_get_priv(dev);
>  	struct prueth *prueth;
> -	char portname[15];
> +	char portname[64];
>  	int ret;
>  
>  	priv->dev = dev;
>  	prueth = dev_get_priv(dev->parent);
>  	priv->prueth = prueth;
>  
> -	sprintf(portname, "%s-%s", dev->parent->name, dev->name);
> +	snprintf(portname, sizeof(portname), "%s-%s", dev->parent->name, dev->name);
> +	portname[sizeof(portname) - 1] = '\0';
>  
>  	device_set_name(dev, portname);
>  

Reviewed-by: Jerome Forissier <jerome.forissier at arm.com>

Thanks,
-- 
Jerome