Messages in this thread | | | Date | Fri, 2 Apr 2010 08:40:53 +0200 | From | Jens Axboe <> | Subject | Re: [PATCH] Block: Fix block/elevator.c elevator_get() off-by-one error |
| |
On Tue, Mar 30 2010, wzt.wzt@gmail.com wrote: > elevator_get() not check the name length, if the name length > sizeof(elv), > elv will miss the '\0'. And elv buffer will be replace "-iosched" as something > like aaaaaaaaa, then call request_module() can load an not trust module.
Thanks, good catch! Applied.
-- Jens Axboe
| |