aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2013-09-11 00:41:16 -0400
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2013-09-17 10:39:27 -0400
commit5418ae3188a9a57f318f51c3c26c0fedfea82f8b (patch)
treea9086ac41676733f1cefaa95d104323ef6d3bc14
parent9edf0f670bdc8fa8b6676893b0a3bd2bf30a2362 (diff)
staging: dgnc: fix potential format string flaw
Make sure that format strings cannot leak into printk() calls from the msgbuf string. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-rw-r--r--drivers/staging/dgnc/dgnc_driver.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/staging/dgnc/dgnc_driver.c b/drivers/staging/dgnc/dgnc_driver.c
index f8c1e22585d6..71d2b83cc3a1 100644
--- a/drivers/staging/dgnc/dgnc_driver.c
+++ b/drivers/staging/dgnc/dgnc_driver.c
@@ -454,7 +454,7 @@ static void dgnc_cleanup_board(struct board_t *brd)
454 454
455 DGNC_LOCK(dgnc_global_lock, flags); 455 DGNC_LOCK(dgnc_global_lock, flags);
456 brd->msgbuf = NULL; 456 brd->msgbuf = NULL;
457 printk(brd->msgbuf_head); 457 printk("%s", brd->msgbuf_head);
458 kfree(brd->msgbuf_head); 458 kfree(brd->msgbuf_head);
459 brd->msgbuf_head = NULL; 459 brd->msgbuf_head = NULL;
460 DGNC_UNLOCK(dgnc_global_lock, flags); 460 DGNC_UNLOCK(dgnc_global_lock, flags);
@@ -710,7 +710,7 @@ static int dgnc_found_board(struct pci_dev *pdev, int id)
710 DPR_INIT(("dgnc_scan(%d) - printing out the msgbuf\n", i)); 710 DPR_INIT(("dgnc_scan(%d) - printing out the msgbuf\n", i));
711 DGNC_LOCK(dgnc_global_lock, flags); 711 DGNC_LOCK(dgnc_global_lock, flags);
712 brd->msgbuf = NULL; 712 brd->msgbuf = NULL;
713 printk(brd->msgbuf_head); 713 printk("%s", brd->msgbuf_head);
714 kfree(brd->msgbuf_head); 714 kfree(brd->msgbuf_head);
715 brd->msgbuf_head = NULL; 715 brd->msgbuf_head = NULL;
716 DGNC_UNLOCK(dgnc_global_lock, flags); 716 DGNC_UNLOCK(dgnc_global_lock, flags);