On 09/05/2026 22:01, Francois Berder wrote:
> portname consists of dev->parent->name ("icssg0-eth",
> "icssg1-eth", or "ethernet") and dev->name is the port node
> name ("port@0" or "port@1"). Every board DTS in the repository
> produces a string that overflows the buffer:
>
> "icssg1-eth-port@0" 17 chars + NUL = 18 bytes (AM642 EVM, IoT2050)
> "ethernet-port@0" 15 chars + NUL = 16 bytes (SR-SOM, phyboard)
>
> This commits increases portname to 64 bytes and replaces sprintf
> by snprintf so that any future DT node name cannot overflow it
> regardless of length.
>
> Signed-off-by: Francois Berder <[email protected]>
> ---
> drivers/net/ti/icssg_prueth.c | 5 +++--
> 1 file changed, 3 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/ti/icssg_prueth.c b/drivers/net/ti/icssg_prueth.c
> index 12a162b9d68..4796d0d67cd 100644
> --- a/drivers/net/ti/icssg_prueth.c
> +++ b/drivers/net/ti/icssg_prueth.c
> @@ -496,14 +496,15 @@ static int prueth_port_probe(struct udevice *dev)
> {
> struct prueth_priv *priv = dev_get_priv(dev);
> struct prueth *prueth;
> - char portname[15];
> + char portname[64];
> int ret;
>
> priv->dev = dev;
> prueth = dev_get_priv(dev->parent);
> priv->prueth = prueth;
>
> - sprintf(portname, "%s-%s", dev->parent->name, dev->name);
> + snprintf(portname, sizeof(portname), "%s-%s", dev->parent->name,
> dev->name);
> + portname[sizeof(portname) - 1] = '\0';
>
> device_set_name(dev, portname);
>
Reviewed-by: Jerome Forissier <[email protected]>
Thanks,
--
Jerome
