提交 4505f40a 编写于 作者: D Dan Carpenter 提交者: David S. Miller

enic: change sprintf() to snprintf()

These are copying data into 16 char arrays.  They all specify that the
first string can't be more than 11 characters but once you add on the
"-rx-" and the NUL character there isn't space for the %d.

The first string is probably never going to be 11 characters, but if it
is then let's truncate the string instead of corrupting memory.
Signed-off-by: NDan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 6b80778d
...@@ -1490,7 +1490,8 @@ static int enic_request_intr(struct enic *enic) ...@@ -1490,7 +1490,8 @@ static int enic_request_intr(struct enic *enic)
for (i = 0; i < enic->rq_count; i++) { for (i = 0; i < enic->rq_count; i++) {
intr = enic_msix_rq_intr(enic, i); intr = enic_msix_rq_intr(enic, i);
sprintf(enic->msix[intr].devname, snprintf(enic->msix[intr].devname,
sizeof(enic->msix[intr].devname),
"%.11s-rx-%d", netdev->name, i); "%.11s-rx-%d", netdev->name, i);
enic->msix[intr].isr = enic_isr_msix_rq; enic->msix[intr].isr = enic_isr_msix_rq;
enic->msix[intr].devid = &enic->napi[i]; enic->msix[intr].devid = &enic->napi[i];
...@@ -1498,20 +1499,23 @@ static int enic_request_intr(struct enic *enic) ...@@ -1498,20 +1499,23 @@ static int enic_request_intr(struct enic *enic)
for (i = 0; i < enic->wq_count; i++) { for (i = 0; i < enic->wq_count; i++) {
intr = enic_msix_wq_intr(enic, i); intr = enic_msix_wq_intr(enic, i);
sprintf(enic->msix[intr].devname, snprintf(enic->msix[intr].devname,
sizeof(enic->msix[intr].devname),
"%.11s-tx-%d", netdev->name, i); "%.11s-tx-%d", netdev->name, i);
enic->msix[intr].isr = enic_isr_msix_wq; enic->msix[intr].isr = enic_isr_msix_wq;
enic->msix[intr].devid = enic; enic->msix[intr].devid = enic;
} }
intr = enic_msix_err_intr(enic); intr = enic_msix_err_intr(enic);
sprintf(enic->msix[intr].devname, snprintf(enic->msix[intr].devname,
sizeof(enic->msix[intr].devname),
"%.11s-err", netdev->name); "%.11s-err", netdev->name);
enic->msix[intr].isr = enic_isr_msix_err; enic->msix[intr].isr = enic_isr_msix_err;
enic->msix[intr].devid = enic; enic->msix[intr].devid = enic;
intr = enic_msix_notify_intr(enic); intr = enic_msix_notify_intr(enic);
sprintf(enic->msix[intr].devname, snprintf(enic->msix[intr].devname,
sizeof(enic->msix[intr].devname),
"%.11s-notify", netdev->name); "%.11s-notify", netdev->name);
enic->msix[intr].isr = enic_isr_msix_notify; enic->msix[intr].isr = enic_isr_msix_notify;
enic->msix[intr].devid = enic; enic->msix[intr].devid = enic;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册