drivers: avoid parsing names as kthread_run() format strings

Calling kthread_run with a single name parameter causes it to be handled
as a format string. Many callers are passing potentially dynamic string
content, so use "%s" in those cases to avoid any potential accidents.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 2 insertions, 3 deletions

diff --git a/fs/nfs/callback.c b/fs/nfs/callback.c
index cff089a412c7..da6a43d19aa3 100644
--- a/fs/nfs/callback.c
+++ b/fs/nfs/callback.c
@@ -211,7 +211,6 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt,
         struct svc_rqst *rqstp;
         int (*callback_svc)(void *vrqstp);
         struct nfs_callback_data *cb_info = &nfs_callback_info[minorversion];
-        char svc_name[12];
         int ret;
 
         nfs_callback_bc_serv(minorversion, xprt, serv);
@@ -235,10 +234,10 @@ static int nfs_callback_start_svc(int minorversion, struct rpc_xprt *xprt,
 
         svc_sock_update_bufs(serv);
 
-        sprintf(svc_name, "nfsv4.%u-svc", minorversion);
         cb_info->serv = serv;
         cb_info->rqst = rqstp;
-        cb_info->task = kthread_run(callback_svc, cb_info->rqst, svc_name);
+        cb_info->task = kthread_run(callback_svc, cb_info->rqst,
+                                    "nfsv4.%u-svc", minorversion);
         if (IS_ERR(cb_info->task)) {
                 ret = PTR_ERR(cb_info->task);
                 svc_exit_thread(cb_info->rqst);