drivers: avoid parsing names as kthread_run() format strings

Calling kthread_run with a single name parameter causes it to be handled
as a format string. Many callers are passing potentially dynamic string
content, so use "%s" in those cases to avoid any potential accidents.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

3 files changed, 4 insertions, 5 deletions

diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
index a2aa97d45670..10d6c41aecad 100644
--- a/fs/lockd/svc.c
+++ b/fs/lockd/svc.c
@@ -305,7 +305,7 @@ static int lockd_start_svc(struct svc_serv *serv)
         svc_sock_update_bufs(serv);
         serv->sv_maxconn = nlm_max_connections;
 
-        nlmsvc_task = kthread_run(lockd, nlmsvc_rqst, serv->sv_name);
+        nlmsvc_task = kthread_run(lockd, nlmsvc_rqst, "%s", serv->sv_name);
         if (IS_ERR(nlmsvc_task)) {
                 error = PTR_ERR(nlmsvc_task);
                 printk(KERN_WARNING
diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index cff089a412c7..da6a43d19aa3 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -211,7 +211,6 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt,
         struct svc_rqst *rqstp;
         int (*callback_svc)(void *vrqstp);
         struct nfs_callback_data *cb_info = &nfs_callback_info[minorversion];
-        char svc_name[12];
         int ret;
 
         nfs_callback_bc_serv(minorversion, xprt, serv);
@@ -235,10 +234,10 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt,
 
         svc_sock_update_bufs(serv);
 
-        sprintf(svc_name, "nfsv4.%u-svc", minorversion);
         cb_info->serv = serv;
         cb_info->rqst = rqstp;
-        cb_info->task = kthread_run(callback_svc, cb_info->rqst, svc_name);
+        cb_info->task = kthread_run(callback_svc, cb_info->rqst,
+                                    "nfsv4.%u-svc", minorversion);
         if (IS_ERR(cb_info->task)) {
                 ret = PTR_ERR(cb_info->task);
                 svc_exit_thread(cb_info->rqst);
diff --git a/fs/nfs/nfs4state.c b/fs/nfs/nfs4state.c
index ff10b4aa534c..55418811a55a 100644
--- a/fs/nfs/nfs4state.c
+++ b/fs/nfs/nfs4state.c
@@ -1194,7 +1194,7 @@ void nfs4_schedule_state_manager(struct nfs_client *clp)
         snprintf(buf, sizeof(buf), "%s-manager",
                         rpc_peeraddr2str(clp->cl_rpcclient, RPC_DISPLAY_ADDR));
         rcu_read_unlock();
-        task = kthread_run(nfs4_run_state_manager, clp, buf);
+        task = kthread_run(nfs4_run_state_manager, clp, "%s", buf);
         if (IS_ERR(task)) {
                 printk(KERN_ERR "%s: kthread_run: %ld\n",
                         __func__, PTR_ERR(task));