iommu debugfs names sprintf() "%08lx" into char name[10]. The "8" in %08lx is a minimum width, so a 64-bit it_index can need up to 16 hex digits plus NUL.
Size the buffer for an unsigned long and use snprintf. Signed-off-by: Xixin Liu <[email protected]> --- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/arch/powerpc/kernel/iommu.c b/arch/powerpc/kernel/iommu.c index ee1b5cb557c9..e8f48aef7832 100644 --- a/arch/powerpc/kernel/iommu.c +++ b/arch/powerpc/kernel/iommu.c @@ -53,10 +53,11 @@ static void iommu_debugfs_add(struct iommu_table *tbl) { - char name[10]; + /* unsigned long hex + NUL; %08lx is a minimum width only */ + char name[2 * sizeof(unsigned long) + 1]; struct dentry *liobn_entry; - sprintf(name, "%08lx", tbl->it_index); + snprintf(name, sizeof(name), "%08lx", tbl->it_index); liobn_entry = debugfs_create_dir(name, iommu_debugfs_dir); debugfs_create_file_unsafe("weight", 0400, liobn_entry, tbl, &iommu_debugfs_fops_weight); @@ -70,9 +71,9 @@ static void iommu_debugfs_del(struct iommu_table *tbl) { - char name[10]; + char name[2 * sizeof(unsigned long) + 1]; - sprintf(name, "%08lx", tbl->it_index); + snprintf(name, sizeof(name), "%08lx", tbl->it_index); debugfs_lookup_and_remove(name, iommu_debugfs_dir); } #else -- 2.43.0
