lkml.org 
[lkml]   [2022]   [Jan]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.19 08/27] scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
    Date
    From: Dan Carpenter <dan.carpenter@oracle.com>

    [ Upstream commit 9020be114a47bf7ff33e179b3bb0016b91a098e6 ]

    The "mybuf" string comes from the user, so we need to ensure that it is NUL
    terminated.

    Link: https://lore.kernel.org/r/20211214070527.GA27934@kili
    Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
    Reviewed-by: James Smart <jsmart2021@gmail.com>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/scsi/lpfc/lpfc_debugfs.c | 4 ++--
    1 file changed, 2 insertions(+), 2 deletions(-)

    diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
    index 2c70e311943ac..0a908d1cc494a 100644
    --- a/drivers/scsi/lpfc/lpfc_debugfs.c
    +++ b/drivers/scsi/lpfc/lpfc_debugfs.c
    @@ -2267,8 +2267,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,
    char mybuf[64];
    char *pbuf;

    - if (nbytes > 64)
    - nbytes = 64;
    + if (nbytes > 63)
    + nbytes = 63;

    memset(mybuf, 0, sizeof(mybuf));

    --
    2.34.1


    \
     
     \ /
      Last update: 2022-01-03 15:27    [W:3.584 / U:0.180 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site