@@ -18,7 +18,7 @@
struct ax88172a_private {
struct mii_bus *mdio;
struct phy_device *phydev;
- char phy_name[20];
+ char phy_name[MII_BUS_ID_SIZE + 3];
u16 phy_addr;
u16 oldmode;
int use_embdphy;
@@ -210,7 +210,10 @@ static int ax88172a_bind(struct usbnet *dev, struct usb_interface *intf)
ret = asix_read_phy_addr(dev, priv->use_embdphy);
if (ret < 0)
goto free;
-
+ if (ret >= PHY_MAX_ADDR) {
+ netdev_err(dev->net, "Invalid PHY ID %x\n", ret);
+ return -ENODEV;
+ }
priv->phy_addr = ret;
ax88172a_reset_phy(dev, priv->use_embdphy);
@@ -308,7 +311,7 @@ static int ax88172a_reset(struct usbnet *dev)
rx_ctl);
/* Connect to PHY */
- snprintf(priv->phy_name, 20, PHY_ID_FMT,
+ snprintf(priv->phy_name, sizeof(priv->phy_name), PHY_ID_FMT,
priv->mdio->id, priv->phy_addr);
priv->phydev = phy_connect(dev->net, priv->phy_name,
GCC compiler (Debian 14.2.0-17) is not happy about printing into a short buffer (when build with `make W=1`): drivers/net/usb/ax88172a.c: In function ‘ax88172a_reset’: include/linux/phy.h:312:20: error: ‘%s’ directive output may be truncated writing up to 60 bytes into a region of size 20 [-Werror=format-truncation=] Indeed, the buffer size is chosen based on some assumptions, while in general the assigned name might not fit. Increase the buffer to cover maximum length of the parameters. With that, change snprintf() to use sizeof() instead of hard coded number. Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com> --- drivers/net/usb/ax88172a.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-)