Messages in this thread Patch in this message | | | Date | Thu, 19 Nov 2009 19:23:31 -0500 | From | Jeff Mahoney <> | Subject | [PATCH] enclosure: fix oops while iterating enclosure_status array |
| |
enclosure_status is expected to be a NULL terminated array of strings but isn't actually NULL terminated. When writing an invalid value to /sys/class/enclosure/.../.../status, it goes off the end of the array and Oopses.
This patch uses the array size instead.
Reported-by: Artur Wojcik <artur.wojcik@intel.com> Signed-off-by: Jeff Mahoney <jeffm@suse.com> --- drivers/misc/enclosure.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)
--- a/drivers/misc/enclosure.c +++ b/drivers/misc/enclosure.c @@ -412,8 +412,9 @@ static ssize_t set_component_status(stru struct enclosure_component *ecomp = to_enclosure_component(cdev); int i; - for (i = 0; enclosure_status[i]; i++) { - if (strncmp(buf, enclosure_status[i], + for (i = 0; i < ARRAY_SIZE(enclosure_status); i++) { + if (enclosure_status[i] && + strncmp(buf, enclosure_status[i], strlen(enclosure_status[i])) == 0 && (buf[strlen(enclosure_status[i])] == '\n' || buf[strlen(enclosure_status[i])] == '\0')) -- Jeff Mahoney
| |