drivers: avoid parsing names as kthread_run() format strings

Calling kthread_run with a single name parameter causes it to be handled
as a format string. Many callers are passing potentially dynamic string
content, so use "%s" in those cases to avoid any potential accidents.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 3 insertions, 2 deletions

diff --git a/drivers/usb/atm/usbatm.c b/drivers/usb/atm/usbatm.c
index d3527dd8b90c..5e0d33a7da58 100644
--- a/drivers/usb/atm/usbatm.c
+++ b/drivers/usb/atm/usbatm.c
@@ -1020,7 +1020,7 @@ static int usbatm_heavy_init(struct usbatm_data *instance)
 {
         struct task_struct *t;
 
-        t = kthread_create(usbatm_do_heavy_init, instance,
+        t = kthread_create(usbatm_do_heavy_init, instance, "%s",
                         instance->driver->driver_name);
         if (IS_ERR(t)) {
                 usb_err(instance, "%s: failed to create kernel_thread (%ld)!\n",
@@ -1076,7 +1076,8 @@ int usbatm_usb_probe(struct usb_interface *intf, const struct usb_device_id *id,
         /* public fields */
 
         instance->driver = driver;
-        snprintf(instance->driver_name, sizeof(instance->driver_name), driver->driver_name);
+        strlcpy(instance->driver_name, driver->driver_name,
+                sizeof(instance->driver_name));
 
         instance->usb_dev = usb_dev;
         instance->usb_intf = intf;