From fb79a4fcb09b49c6d6ef0a9a030e1abef32358e9 Mon Sep 17 00:00:00 2001 From: Daniel Golle Date: Sat, 15 Aug 2026 16:08:45 +0100 Subject: disk: ubi: use a format string when copying the volume name part_get_info_ubi() passes the UBI volume name straight to snprintf() as its format argument: snprintf(info->name, PART_NAME_LEN, vol->name); A volume name that contains a '%' is then interpreted as a printf conversion specifier, yielding a wrong partition name or reading unintended variadic arguments; a '%n' would be undefined behaviour. Volume names are user-defined and boot methods select images by volume name, so copy the name through a "%s" format instead. Fixes: aa5b67ce2262 ("disk: support UBI partitions") Signed-off-by: Daniel Golle Reviewed-by: Heiko Schocher --- drivers/mtd/ubi/part.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/mtd/ubi/part.c b/drivers/mtd/ubi/part.c index 6c017eb7299..aff0b109b70 100644 --- a/drivers/mtd/ubi/part.c +++ b/drivers/mtd/ubi/part.c @@ -49,7 +49,7 @@ static int __maybe_unused part_get_info_ubi(struct blk_desc *dev_desc, int part_ if (!vol) return -ENOENT; - snprintf(info->name, PART_NAME_LEN, vol->name); + snprintf(info->name, PART_NAME_LEN, "%s", vol->name); info->start = 0; info->size = (unsigned long)vol->used_bytes / dev_desc->blksz; -- cgit v1.3.1