Commit ca749b2a authored by Daniel Mack's avatar Daniel Mack Committed by Felipe Balbi

usb: musb: dsps: fix res_name length

The res_name is used for the name construction of a DT property as
follows:

  sprintf(res_name, "port%d-mode", id);

Hence, res_name must be at least 11 characters long in order to store
the name including the terminating '\0'.

While at it, use to snprintf() rather than sprintf() when accessing this
buffer.
Reported-by: default avatarDavid Binderman <dcb314@hotmail.com>
Signed-off-by: default avatarDaniel Mack <zonque@gmail.com>
Signed-off-by: default avatarFelipe Balbi <balbi@ti.com>
parent 6f0c0580
...@@ -458,11 +458,11 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id) ...@@ -458,11 +458,11 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id)
struct platform_device *musb; struct platform_device *musb;
struct resource *res; struct resource *res;
struct resource resources[2]; struct resource resources[2];
char res_name[10]; char res_name[11];
int ret, musbid; int ret, musbid;
/* get memory resource */ /* get memory resource */
sprintf(res_name, "musb%d", id); snprintf(res_name, sizeof(res_name), "musb%d", id);
res = platform_get_resource_byname(pdev, IORESOURCE_MEM, res_name); res = platform_get_resource_byname(pdev, IORESOURCE_MEM, res_name);
if (!res) { if (!res) {
dev_err(dev, "%s get mem resource failed\n", res_name); dev_err(dev, "%s get mem resource failed\n", res_name);
...@@ -473,7 +473,7 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id) ...@@ -473,7 +473,7 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id)
resources[0] = *res; resources[0] = *res;
/* get irq resource */ /* get irq resource */
sprintf(res_name, "musb%d-irq", id); snprintf(res_name, sizeof(res_name), "musb%d-irq", id);
res = platform_get_resource_byname(pdev, IORESOURCE_IRQ, res_name); res = platform_get_resource_byname(pdev, IORESOURCE_IRQ, res_name);
if (!res) { if (!res) {
dev_err(dev, "%s get irq resource failed\n", res_name); dev_err(dev, "%s get irq resource failed\n", res_name);
...@@ -530,7 +530,7 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id) ...@@ -530,7 +530,7 @@ static int __devinit dsps_create_musb_pdev(struct dsps_glue *glue, u8 id)
of_property_read_u32(np, "num-eps", (u32 *)&config->num_eps); of_property_read_u32(np, "num-eps", (u32 *)&config->num_eps);
of_property_read_u32(np, "ram-bits", (u32 *)&config->ram_bits); of_property_read_u32(np, "ram-bits", (u32 *)&config->ram_bits);
sprintf(res_name, "port%d-mode", id); snprintf(res_name, sizeof(res_name), "port%d-mode", id);
of_property_read_u32(np, res_name, (u32 *)&pdata->mode); of_property_read_u32(np, res_name, (u32 *)&pdata->mode);
of_property_read_u32(np, "power", (u32 *)&pdata->power); of_property_read_u32(np, "power", (u32 *)&pdata->power);
config->multipoint = of_property_read_bool(np, "multipoint"); config->multipoint = of_property_read_bool(np, "multipoint");
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment