sh_mtu2_setup_channel() formats the per-channel interrupt name into a
6-byte buffer:

	char name[6];
	sprintf(name, "tgi%ua", index);

which only has room for a single-digit index.  gcc reports with W=1:

  sh_mtu2.c:348:27: warning: '%u' directive writing between 1 and 10
  bytes into a region of size 3 [-Wformat-overflow=]

Callers pass indices below ARRAY_SIZE(sh_mtu2_channel_offsets), that is
at most 2, so the overflow is not reachable today.  Still, the buffer
size does not match what the format string allows, and the bound lives
in the caller rather than in this function.

Size the buffer for the widest possible unsigned int, which makes the
sprintf() correct for any index.

No functional change.

Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/all/202501080036.LH3XAQK1-lkp@intel.com/

Signed-off-by: xujiahao <xujiahao@cmss.chinamobile.com>
---
 drivers/clocksource/sh_mtu2.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/clocksource/sh_mtu2.c b/drivers/clocksource/sh_mtu2.c
index 3aca86d6a..f94167bed 100644
--- a/drivers/clocksource/sh_mtu2.c
+++ b/drivers/clocksource/sh_mtu2.c
@@ -339,7 +339,7 @@ static const unsigned int sh_mtu2_channel_offsets[] = {
 static int sh_mtu2_setup_channel(struct sh_mtu2_channel *ch, unsigned int index,
 				 struct sh_mtu2_device *mtu)
 {
-	char name[6];
+	char name[16];
 	int irq;
 	int ret;
 
-- 
2.43.0