[PATCH net 1/3] octeontx2-af: Fix mcs string buffer size

[Subrat Pandey <subratp@marvell.com>]

From: Stefan Wiehler <stefan.wiehler@nokia.com>

The "mcs%d" name is built with the unbounded sprintf(), which writes
without any regard for the size of the destination buffer and can
overrun it. Switch to snprintf() with sizeof() so the formatted write
is always clamped to the buffer. The buffer is also enlarged to
24 bytes to comfortably hold the string for any MCS block index.

Fixes: d06c2aba5163 ("octeontx2-af: cn10k: mcs: Add debugfs support").
Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com>
Signed-off-by: Subrat Pandey <subratp@marvell.com>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
index 3456313d3b3c..a13848f26ae9 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -497,7 +497,7 @@ RVU_DEBUG_SEQ_FOPS(mcs_rx_secy_stats, mcs_rx_secy_stats_display, NULL);
 static void rvu_dbg_mcs_init(struct rvu *rvu)
 {
 	struct mcs *mcs;
-	char dname[10];
+	char dname[24];
 	int i;
 
 	if (!rvu->mcs_blk_cnt)
@@ -508,7 +508,7 @@ static void rvu_dbg_mcs_init(struct rvu *rvu)
 	for (i = 0; i < rvu->mcs_blk_cnt; i++) {
 		mcs = mcs_get_pdata(i);
 
-		sprintf(dname, "mcs%d", i);
+		snprintf(dname, sizeof(dname), "mcs%d", i);
 		rvu->rvu_dbg.mcs = debugfs_create_dir(dname,
 						      rvu->rvu_dbg.mcs_root);
 
-- 
2.43.0