usb: musb: dsps: fix res_name length
The res_name is used for the name construction of a DT property as
follows:
sprintf(res_name, "port%d-mode", id);
Hence, res_name must be at least 11 characters long in order to store
the name including the terminating '\0'.
While at it, use to snprintf() rather than sprintf() when accessing this
buffer.
Reported-by: David Binderman <dcb314@hotmail.com>
Signed-off-by: Daniel Mack <zonque@gmail.com>
Signed-off-by: Felipe Balbi <balbi@ti.com>
diff --git a/drivers/usb/musb/musb_dsps.c b/drivers/usb/musb/musb_dsps.c
index 444346e1..ff5f112 100644
--- a/drivers/usb/musb/musb_dsps.c
+++ b/drivers/usb/musb/musb_dsps.c
@@ -458,11 +458,11 @@
struct platform_device *musb;
struct resource *res;
struct resource resources[2];
- char res_name[10];
+ char res_name[11];
int ret, musbid;
/* get memory resource */
- sprintf(res_name, "musb%d", id);
+ snprintf(res_name, sizeof(res_name), "musb%d", id);
res = platform_get_resource_byname(pdev, IORESOURCE_MEM, res_name);
if (!res) {
dev_err(dev, "%s get mem resource failed\n", res_name);
@@ -473,7 +473,7 @@
resources[0] = *res;
/* get irq resource */
- sprintf(res_name, "musb%d-irq", id);
+ snprintf(res_name, sizeof(res_name), "musb%d-irq", id);
res = platform_get_resource_byname(pdev, IORESOURCE_IRQ, res_name);
if (!res) {
dev_err(dev, "%s get irq resource failed\n", res_name);
@@ -530,7 +530,7 @@
of_property_read_u32(np, "num-eps", (u32 *)&config->num_eps);
of_property_read_u32(np, "ram-bits", (u32 *)&config->ram_bits);
- sprintf(res_name, "port%d-mode", id);
+ snprintf(res_name, sizeof(res_name), "port%d-mode", id);
of_property_read_u32(np, res_name, (u32 *)&pdata->mode);
of_property_read_u32(np, "power", (u32 *)&pdata->power);
config->multipoint = of_property_read_bool(np, "multipoint");