Use the correct size for "name" in register_with_devfs(). During Al Viro's devfs cleanup a few versions ago, this function was rewritten, and the "name" string added. The 32-byte size is not large enough to prevent a possible buffer overflow in the sprintf() call, since the hash cell can have a name up to 128 characters. --- linux-2.5.56a/drivers/md/dm-ioctl.c Fri Jan 10 14:11:40 2003 +++ linux-2.5.56b/drivers/md/dm-ioctl.c Fri Jan 10 15:06:20 2003 @@ -173,7 +173,7 @@ */ static int register_with_devfs(struct hash_cell *hc) { - char name[32]; + char name[DM_NAME_LEN+strlen(DM_DIR)+1]; struct gendisk *disk = dm_disk(hc->md); sprintf(name, DM_DIR "/%s", hc->name);