drivers: avoid format string in dev_set_name

Calling dev_set_name with a single paramter causes it to be handled as a
format string.  Many callers are passing potentially dynamic string
content, so use "%s" in those cases to avoid any potential accidents,
including wrappers like device_create*() and bdi_register().

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 2 insertions, 3 deletions

diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 502517492258..d014ee5fcbbd 100644
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -515,7 +515,6 @@ EXPORT_SYMBOL(bdi_destroy);
 int bdi_setup_and_register(struct backing_dev_info *bdi, char *name,
                            unsigned int cap)
 {
-        char tmp[32];
         int err;
 
         bdi->name = name;
@@ -524,8 +523,8 @@ int bdi_setup_and_register(struct backing_dev_info *bdi, char *name,
         if (err)
                 return err;
 
-        sprintf(tmp, "%.28s%s", name, "-%d");
-        err = bdi_register(bdi, NULL, tmp, atomic_long_inc_return(&bdi_seq));
+        err = bdi_register(bdi, NULL, "%.28s-%ld", name,
+                           atomic_long_inc_return(&bdi_seq));
         if (err) {
                 bdi_destroy(bdi);
                 return err;