diff options
author | Kees Cook <keescook@chromium.org> | 2013-09-11 00:41:16 -0400 |
---|---|---|
committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2013-09-17 10:39:27 -0400 |
commit | 5418ae3188a9a57f318f51c3c26c0fedfea82f8b (patch) | |
tree | a9086ac41676733f1cefaa95d104323ef6d3bc14 | |
parent | 9edf0f670bdc8fa8b6676893b0a3bd2bf30a2362 (diff) |
staging: dgnc: fix potential format string flaw
Make sure that format strings cannot leak into printk() calls from the
msgbuf string.
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r-- | drivers/staging/dgnc/dgnc_driver.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/dgnc/dgnc_driver.c b/drivers/staging/dgnc/dgnc_driver.c index f8c1e22585d6..71d2b83cc3a1 100644 --- a/drivers/staging/dgnc/dgnc_driver.c +++ b/drivers/staging/dgnc/dgnc_driver.c | |||
@@ -454,7 +454,7 @@ static void dgnc_cleanup_board(struct board_t *brd) | |||
454 | 454 | ||
455 | DGNC_LOCK(dgnc_global_lock, flags); | 455 | DGNC_LOCK(dgnc_global_lock, flags); |
456 | brd->msgbuf = NULL; | 456 | brd->msgbuf = NULL; |
457 | printk(brd->msgbuf_head); | 457 | printk("%s", brd->msgbuf_head); |
458 | kfree(brd->msgbuf_head); | 458 | kfree(brd->msgbuf_head); |
459 | brd->msgbuf_head = NULL; | 459 | brd->msgbuf_head = NULL; |
460 | DGNC_UNLOCK(dgnc_global_lock, flags); | 460 | DGNC_UNLOCK(dgnc_global_lock, flags); |
@@ -710,7 +710,7 @@ static int dgnc_found_board(struct pci_dev *pdev, int id) | |||
710 | DPR_INIT(("dgnc_scan(%d) - printing out the msgbuf\n", i)); | 710 | DPR_INIT(("dgnc_scan(%d) - printing out the msgbuf\n", i)); |
711 | DGNC_LOCK(dgnc_global_lock, flags); | 711 | DGNC_LOCK(dgnc_global_lock, flags); |
712 | brd->msgbuf = NULL; | 712 | brd->msgbuf = NULL; |
713 | printk(brd->msgbuf_head); | 713 | printk("%s", brd->msgbuf_head); |
714 | kfree(brd->msgbuf_head); | 714 | kfree(brd->msgbuf_head); |
715 | brd->msgbuf_head = NULL; | 715 | brd->msgbuf_head = NULL; |
716 | DGNC_UNLOCK(dgnc_global_lock, flags); | 716 | DGNC_UNLOCK(dgnc_global_lock, flags); |