drivers: avoid format string in dev_set_name

Calling dev_set_name with a single paramter causes it to be handled as a
format string.  Many callers are passing potentially dynamic string
content, so use "%s" in those cases to avoid any potential accidents,
including wrappers like device_create*() and bdi_register().

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/drivers/base/attribute_container.c b/drivers/base/attribute_container.c
index d78b204e65c1728603384bb4f00f5e54f0601f69..ecc1929d7f6a943a086112ad5d61df8816fba8ad 100644 (file)
--- a/drivers/base/attribute_container.c
+++ b/drivers/base/attribute_container.c
@@ -167,7 +167,7 @@ attribute_container_add_device(struct device *dev,
                ic->classdev.parent = get_device(dev);
                ic->classdev.class = cont->class;
                cont->class->dev_release = attribute_container_release;
-               dev_set_name(&ic->classdev, dev_name(dev));
+               dev_set_name(&ic->classdev, "%s", dev_name(dev));
                if (fn)
                        fn(cont, dev, &ic->classdev);
                else

diff --git a/drivers/devfreq/devfreq.c b/drivers/devfreq/devfreq.c
index 3b367973a8028c5d1cd32bd823bcf9e005d269b6..af8372feb587aa7a702ced82c5a460b07c642c23 100644 (file)
--- a/drivers/devfreq/devfreq.c
+++ b/drivers/devfreq/devfreq.c
@@ -477,7 +477,7 @@ struct devfreq *devfreq_add_device(struct device *dev,
                                                GFP_KERNEL);
        devfreq->last_stat_updated = jiffies;
 
-       dev_set_name(&devfreq->dev, dev_name(dev));
+       dev_set_name(&devfreq->dev, "%s", dev_name(dev));
        err = device_register(&devfreq->dev);
        if (err) {
                put_device(&devfreq->dev);

diff --git a/drivers/extcon/extcon-class.c b/drivers/extcon/extcon-class.c
index 8c69803558fe9f70df26fcbba6720a5c1cf3aec4..18ccadef43fdd80f81cff69501db3679c8e6b078 100644 (file)
--- a/drivers/extcon/extcon-class.c
+++ b/drivers/extcon/extcon-class.c
@@ -602,7 +602,7 @@ int extcon_dev_register(struct extcon_dev *edev, struct device *dev)
        edev->dev->class = extcon_class;
        edev->dev->release = extcon_dev_release;
 
-       dev_set_name(edev->dev, edev->name ? edev->name : dev_name(dev));
+       dev_set_name(edev->dev, "%s", edev->name ? edev->name : dev_name(dev));
 
        if (edev->max_supported) {
                char buf[10];

diff --git a/drivers/hsi/hsi.c b/drivers/hsi/hsi.c
index 833dd1afbf463627b10062ce16474004a887c10e..66d44581e1b1e74a242a8b8cdbf28ac3196325c3 100644 (file)
--- a/drivers/hsi/hsi.c
+++ b/drivers/hsi/hsi.c
@@ -75,7 +75,7 @@ static void hsi_new_client(struct hsi_port *port, struct hsi_board_info *info)
        cl->device.bus = &hsi_bus_type;
        cl->device.parent = &port->device;
        cl->device.release = hsi_client_release;
-       dev_set_name(&cl->device, info->name);
+       dev_set_name(&cl->device, "%s", info->name);
        cl->device.platform_data = info->platform_data;
        if (info->archdata)
                cl->device.archdata = *info->archdata;

diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index 2ff6204449300e088883d411b3c4f0f46d2eabaf..0b510bafd90e2904d989d4f8ce06b89f50ea1f76 100644 (file)
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -1756,7 +1756,7 @@ static int ide_cd_probe(ide_drive_t *drive)
 
        info->dev.parent = &drive->gendev;
        info->dev.release = ide_cd_release;
-       dev_set_name(&info->dev, dev_name(&drive->gendev));
+       dev_set_name(&info->dev, "%s", dev_name(&drive->gendev));
 
        if (device_register(&info->dev))
                goto out_free_disk;

diff --git a/drivers/ide/ide-gd.c b/drivers/ide/ide-gd.c
index de86631e767d6d08b6c500e3162aa5ca50551c85..838996a0039e18547a929099e5e631ccbb96f924 100644 (file)
--- a/drivers/ide/ide-gd.c
+++ b/drivers/ide/ide-gd.c
@@ -392,7 +392,7 @@ static int ide_gd_probe(ide_drive_t *drive)
 
        idkp->dev.parent = &drive->gendev;
        idkp->dev.release = ide_disk_release;
-       dev_set_name(&idkp->dev, dev_name(&drive->gendev));
+       dev_set_name(&idkp->dev, "%s", dev_name(&drive->gendev));
 
        if (device_register(&idkp->dev))
                goto out_free_disk;

diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 068cef0a987aa672566d986eb7353670d533fdd6..2a744a91370e640d1fe3603409b80e776d8041de 100644 (file)
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -545,7 +545,7 @@ static int ide_register_port(ide_hwif_t *hwif)
        int ret;
 
        /* register with global device tree */
-       dev_set_name(&hwif->gendev, hwif->name);
+       dev_set_name(&hwif->gendev, "%s", hwif->name);
        dev_set_drvdata(&hwif->gendev, hwif);
        if (hwif->gendev.parent == NULL)
                hwif->gendev.parent = hwif->dev;
@@ -559,7 +559,7 @@ static int ide_register_port(ide_hwif_t *hwif)
        }
 
        hwif->portdev = device_create(ide_port_class, &hwif->gendev,
-                                     MKDEV(0, 0), hwif, hwif->name);
+                                     MKDEV(0, 0), hwif, "%s", hwif->name);
        if (IS_ERR(hwif->portdev)) {
                ret = PTR_ERR(hwif->portdev);
                device_unregister(&hwif->gendev);

diff --git a/drivers/ide/ide-tape.c b/drivers/ide/ide-tape.c
index c6c574bd5f59e079199072e0f27311804f4faff4..1793aea4a7d2c58192f6023d43e90c10daedbb52 100644 (file)
--- a/drivers/ide/ide-tape.c
+++ b/drivers/ide/ide-tape.c
@@ -1985,7 +1985,7 @@ static int ide_tape_probe(ide_drive_t *drive)
 
        tape->dev.parent = &drive->gendev;
        tape->dev.release = ide_tape_release;
-       dev_set_name(&tape->dev, dev_name(&drive->gendev));
+       dev_set_name(&tape->dev, "%s", dev_name(&drive->gendev));
 
        if (device_register(&tape->dev))
                goto out_free_disk;

diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index 246fdc1516524cbc31940a6ed946e9b14ec741e8..99904f7d59e3ccda6cbffeaa6c0c2d2b66924690 100644 (file)
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -813,7 +813,7 @@ int ib_device_register_sysfs(struct ib_device *device,
 
        class_dev->class      = &ib_class;
        class_dev->parent     = device->dma_device;
-       dev_set_name(class_dev, device->name);
+       dev_set_name(class_dev, "%s", device->name);
        dev_set_drvdata(class_dev, device);
 
        INIT_LIST_HEAD(&device->port_list);

diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c
index b56c9428f3c5f5fbf574b0b9570ec2caa02cbee3..9dd0bc89c3aa83a6bf4b89faa3ce6c20e4648e3e 100644 (file)
--- a/drivers/infiniband/hw/qib/qib_file_ops.c
+++ b/drivers/infiniband/hw/qib/qib_file_ops.c
@@ -2208,7 +2208,7 @@ int qib_cdev_init(int minor, const char *name,
                goto err_cdev;
        }
 
-       device = device_create(qib_class, NULL, dev, NULL, name);
+       device = device_create(qib_class, NULL, dev, NULL, "%s", name);
        if (!IS_ERR(device))
                goto done;
        ret = PTR_ERR(device);

diff --git a/drivers/isdn/mISDN/dsp_pipeline.c b/drivers/isdn/mISDN/dsp_pipeline.c
index 88305c9cbff5334a474345a16860b6f727d3e614..8b1a66c6ca8aa0e3c5a647945ba895172d3a4974 100644 (file)
--- a/drivers/isdn/mISDN/dsp_pipeline.c
+++ b/drivers/isdn/mISDN/dsp_pipeline.c
@@ -102,7 +102,7 @@ int mISDN_dsp_element_register(struct mISDN_dsp_element *elem)
        entry->dev.class = elements_class;
        entry->dev.release = mISDN_dsp_dev_release;
        dev_set_drvdata(&entry->dev, elem);
-       dev_set_name(&entry->dev, elem->name);
+       dev_set_name(&entry->dev, "%s", elem->name);
        ret = device_register(&entry->dev);
        if (ret) {
                printk(KERN_ERR "%s: failed to register %s\n",

diff --git a/drivers/mtd/mtdcore.c b/drivers/mtd/mtdcore.c
index c400c57c394aaddb26147bfe2b1955c6716f74d5..048c823f5c51397df8c5e6ef023ba287ab65b02f 100644 (file)
--- a/drivers/mtd/mtdcore.c
+++ b/drivers/mtd/mtdcore.c
@@ -1151,7 +1151,7 @@ static int __init mtd_bdi_init(struct backing_dev_info *bdi, const char *name)
 
        ret = bdi_init(bdi);
        if (!ret)
-               ret = bdi_register(bdi, NULL, name);
+               ret = bdi_register(bdi, NULL, "%s", name);
 
        if (ret)
                bdi_destroy(bdi);

diff --git a/drivers/platform/x86/wmi.c b/drivers/platform/x86/wmi.c
index e4ac38aca5802ef995ad84fc9d191749075771ff..b13344c59808a50b984fdd275810a531f3515a73 100644 (file)
--- a/drivers/platform/x86/wmi.c
+++ b/drivers/platform/x86/wmi.c
@@ -743,7 +743,7 @@ static int wmi_create_device(const struct guid_block *gblock,
        wblock->dev.class = &wmi_class;
 
        wmi_gtoa(gblock->guid, guid_string);
-       dev_set_name(&wblock->dev, guid_string);
+       dev_set_name(&wblock->dev, "%s", guid_string);
 
        dev_set_drvdata(&wblock->dev, wblock);
 

diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
index c1c555242d0d715d46c051955deacea4a819d634..8fa3d0b73ad9bf42164f9e4fbd633fb056018736 100644 (file)
--- a/drivers/scsi/sd.c
+++ b/drivers/scsi/sd.c
@@ -2931,7 +2931,7 @@ static int sd_probe(struct device *dev)
        device_initialize(&sdkp->dev);
        sdkp->dev.parent = dev;
        sdkp->dev.class = &sd_disk_class;
-       dev_set_name(&sdkp->dev, dev_name(dev));
+       dev_set_name(&sdkp->dev, "%s", dev_name(dev));
 
        if (device_add(&sdkp->dev))
                goto out_free_index;

diff --git a/drivers/staging/android/timed_output.c b/drivers/staging/android/timed_output.c
index ec9e2ae2de0da21f24451335c64fccc7a27b75be..ee3a57f22832ba9bd5ccba77139f8df476d34e3f 100644 (file)
--- a/drivers/staging/android/timed_output.c
+++ b/drivers/staging/android/timed_output.c
@@ -78,7 +78,7 @@ int timed_output_dev_register(struct timed_output_dev *tdev)
 
        tdev->index = atomic_inc_return(&device_count);
        tdev->dev = device_create(timed_output_class, NULL,
-               MKDEV(0, tdev->index), NULL, tdev->name);
+               MKDEV(0, tdev->index), NULL, "%s", tdev->name);
        if (IS_ERR(tdev->dev))
                return PTR_ERR(tdev->dev);
 

diff --git a/drivers/staging/dgrp/dgrp_sysfs.c b/drivers/staging/dgrp/dgrp_sysfs.c
index 7d1b36d1e75fc57f8120c06c16754c20e5bddc40..8cee9c8bc38b1850b8bdcc3edad37e91a6996515 100644 (file)
--- a/drivers/staging/dgrp/dgrp_sysfs.c
+++ b/drivers/staging/dgrp/dgrp_sysfs.c
@@ -273,7 +273,7 @@ void dgrp_create_node_class_sysfs_files(struct nd_struct *nd)
                sprintf(name, "node%ld", nd->nd_major);
 
        nd->nd_class_dev = device_create(dgrp_class, dgrp_class_nodes_dev,
-               MKDEV(0, nd->nd_major), NULL, name);
+               MKDEV(0, nd->nd_major), NULL, "%s", name);
 
        ret = sysfs_create_group(&nd->nd_class_dev->kobj,
                                 &dgrp_node_attribute_group);

diff --git a/drivers/uwb/lc-dev.c b/drivers/uwb/lc-dev.c
index 5241f1d0ef7a3d3b3bb878a1729c6f93b98144c1..9209eafc75b1f004e407965c32c3a683abdf5ed2 100644 (file)
--- a/drivers/uwb/lc-dev.c
+++ b/drivers/uwb/lc-dev.c
@@ -440,7 +440,7 @@ void uwbd_dev_onair(struct uwb_rc *rc, struct uwb_beca_e *bce)
        uwb_dev_init(uwb_dev);          /* This sets refcnt to one, we own it */
        uwb_dev->mac_addr = *bce->mac_addr;
        uwb_dev->dev_addr = bce->dev_addr;
-       dev_set_name(&uwb_dev->dev, macbuf);
+       dev_set_name(&uwb_dev->dev, "%s", macbuf);
        result = uwb_dev_add(uwb_dev, &rc->uwb_dev.dev, rc);
        if (result < 0) {
                dev_err(dev, "new device %s: cannot instantiate device\n",

diff --git a/drivers/video/backlight/backlight.c b/drivers/video/backlight/backlight.c
index c74e7aa467312097de2944452ad428ab8fe41b46..e3c2790832539cb304095251263201fa6ff529a5 100644 (file)
--- a/drivers/video/backlight/backlight.c
+++ b/drivers/video/backlight/backlight.c
@@ -304,7 +304,7 @@ struct backlight_device *backlight_device_register(const char *name,
        new_bd->dev.class = backlight_class;
        new_bd->dev.parent = parent;
        new_bd->dev.release = bl_device_release;
-       dev_set_name(&new_bd->dev, name);
+       dev_set_name(&new_bd->dev, "%s", name);
        dev_set_drvdata(&new_bd->dev, devdata);
 
        /* Set default properties */

diff --git a/drivers/video/backlight/lcd.c b/drivers/video/backlight/lcd.c
index 34fb6bd798c84bb82e79b7f651a380b0547955cd..3649fd9ddb3a951b6e6ff669ef36dbcee8f3ebed 100644 (file)
--- a/drivers/video/backlight/lcd.c
+++ b/drivers/video/backlight/lcd.c
@@ -219,7 +219,7 @@ struct lcd_device *lcd_device_register(const char *name, struct device *parent,
        new_ld->dev.class = lcd_class;
        new_ld->dev.parent = parent;
        new_ld->dev.release = lcd_device_release;
-       dev_set_name(&new_ld->dev, name);
+       dev_set_name(&new_ld->dev, "%s", name);
        dev_set_drvdata(&new_ld->dev, devdata);
 
        rc = device_register(&new_ld->dev);

diff --git a/drivers/video/output.c b/drivers/video/output.c
index 0d6f2cda93696fa96322d77a15f122d81555311a..6285b97184510726cc3900b2092584aaae8fc930 100644 (file)
--- a/drivers/video/output.c
+++ b/drivers/video/output.c
@@ -97,7 +97,7 @@ struct output_device *video_output_register(const char *name,
        new_dev->props = op;
        new_dev->dev.class = &video_output_class;
        new_dev->dev.parent = dev;
-       dev_set_name(&new_dev->dev, name);
+       dev_set_name(&new_dev->dev, "%s", name);
        dev_set_drvdata(&new_dev->dev, devdata);
        ret_code = device_register(&new_dev->dev);
        if (ret_code) {

diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c
index 56cfaaa9d006ab1b86c47d6c1a9f1ab90268f399..8c9db16500e315d4b1c9b25634a20f1b0eef1bb4 100644 (file)
--- a/drivers/xen/xenbus/xenbus_probe.c
+++ b/drivers/xen/xenbus/xenbus_probe.c
@@ -447,7 +447,7 @@ int xenbus_probe_node(struct xen_bus_type *bus,
        if (err)
                goto fail;
 
-       dev_set_name(&xendev->dev, devname);
+       dev_set_name(&xendev->dev, "%s", devname);
 
        /* Register with generic device framework. */
        err = device_register(&xendev->dev);

diff --git a/mm/backing-dev.c b/mm/backing-dev.c
index 50251749225885d958a1b531519326bd177ecf2e..d014ee5fcbbd2fa8004ae642f83571ddd949a5e6 100644 (file)
--- a/mm/backing-dev.c
+++ b/mm/backing-dev.c
@@ -515,7 +515,6 @@ EXPORT_SYMBOL(bdi_destroy);
 int bdi_setup_and_register(struct backing_dev_info *bdi, char *name,
                           unsigned int cap)
 {
-       char tmp[32];
        int err;
 
        bdi->name = name;
@@ -524,8 +523,8 @@ int bdi_setup_and_register(struct backing_dev_info *bdi, char *name,
        if (err)
                return err;
 
-       sprintf(tmp, "%.28s%s", name, "-%d");
-       err = bdi_register(bdi, NULL, tmp, atomic_long_inc_return(&bdi_seq));
+       err = bdi_register(bdi, NULL, "%.28s-%ld", name,
+                          atomic_long_inc_return(&bdi_seq));
        if (err) {
                bdi_destroy(bdi);
                return err;

diff --git a/sound/sound_core.c b/sound/sound_core.c
index 359753fc24e161931bb0a95070331aba59c87aff..45759f4cca754488d38f15bcae85b161a85fb4a9 100644 (file)
--- a/sound/sound_core.c
+++ b/sound/sound_core.c
@@ -292,7 +292,7 @@ retry:
        }
 
        device_create(sound_class, dev, MKDEV(SOUND_MAJOR, s->unit_minor),
-                     NULL, s->name+6);
+                     NULL, "%s", s->name+6);
        return s->unit_minor;
 
 fail: