From: Prakash Gupta <guptap@xxxxxxxxxxxxxx> Subject: mm/cma_debug.c: fix stack corruption due to sprintf usage name[] in cma_debugfs_add_one() can only accommodate 16 chars including NULL to store sprintf output. It's common for cma device name to be larger than 15 chars. This can cause stack corrpution. If the gcc stack protector is turned on, this can cause a panic due to stack corruption. Below is one example trace: Kernel panic - not syncing: stack-protector: Kernel stack is corrupted in: ffffff8e69a75730 Call trace: [<ffffff8e68289504>] dump_backtrace+0x0/0x2c4 [<ffffff8e682897e8>] show_stack+0x20/0x28 [<ffffff8e685ea808>] dump_stack+0xb8/0xf4 [<ffffff8e683c454c>] panic+0x154/0x2b0 [<ffffff8e682a724c>] print_tainted+0x0/0xc0 [<ffffff8e69a75730>] cma_debugfs_init+0x274/0x290 [<ffffff8e682839ec>] do_one_initcall+0x5c/0x168 [<ffffff8e69a50e24>] kernel_init_freeable+0x1c8/0x280 Fix the short sprintf buffer in cma_debugfs_add_one() by using scnprintf() instead of sprintf(). Link: http://lkml.kernel.org/r/1502446217-21840-1-git-send-email-guptap@xxxxxxxxxxxxxx Fixes: f318dd083c81 ("cma: Store a name in the cma structure") Signed-off-by: Prakash Gupta <guptap@xxxxxxxxxxxxxx> Acked-by: Laura Abbott <labbott@xxxxxxxxxx> Cc: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Cc: <stable@xxxxxxxxxxxxxxx> Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx> --- mm/cma_debug.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff -puN mm/cma_debug.c~mm-cma-fix-stack-corruption-due-to-sprintf-usage mm/cma_debug.c --- a/mm/cma_debug.c~mm-cma-fix-stack-corruption-due-to-sprintf-usage +++ a/mm/cma_debug.c @@ -167,7 +167,7 @@ static void cma_debugfs_add_one(struct c char name[16]; int u32s; - sprintf(name, "cma-%s", cma->name); + scnprintf(name, sizeof(name), "cma-%s", cma->name); tmp = debugfs_create_dir(name, cma_debugfs_root); _