From 086e8bbff65171bb1cbdab2d7ba430155276afbe Mon Sep 17 00:00:00 2001 From: Chanho Park Date: Tue, 4 Aug 2020 17:57:58 +0900 Subject: [PATCH] ANDROID: tty: fix tty name overflow The tty name can be up to 8 chars if id is greater than 10 such as ttyUSB11. In that case, the name will be overflowed. To prevent this, this patch removes snprintf and adds comparison the idx value of pdev_tty_port only if pdev_tty_port is specified. Bug: 157525691 Bug: 161501868 Fixes: 21d085e1cc2c ("ANDROID: serdev: restrict claim of platform devices") Change-Id: I2a766c9a83a09a1d386686638d8e9c529eeeb735 Signed-off-by: Chanho Park --- drivers/tty/serdev/serdev-ttyport.c | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/drivers/tty/serdev/serdev-ttyport.c b/drivers/tty/serdev/serdev-ttyport.c index 67bb0a0b730e..6cdffde2d682 100644 --- a/drivers/tty/serdev/serdev-ttyport.c +++ b/drivers/tty/serdev/serdev-ttyport.c @@ -301,12 +301,16 @@ struct device *serdev_tty_port_register(struct tty_port *port, * be ignored. */ if (parent->bus == &platform_bus_type) { - char tty_port_name[7]; + if (pdev_tty_port) { + unsigned long pdev_idx; + int tty_len = strlen(drv->name); - sprintf(tty_port_name, "%s%d", drv->name, idx); - if (pdev_tty_port && - !strcmp(pdev_tty_port, tty_port_name)) { - platform = true; + if (!strncmp(pdev_tty_port, drv->name, tty_len)) { + if (!kstrtoul(pdev_tty_port + tty_len, 10, + &pdev_idx) && pdev_idx == idx) { + platform = true; + } + } } }