diff options
author | Alan <gnomes@lxorguk.ukuu.org.uk> | 2016-02-15 14:11:56 -0500 |
---|---|---|
committer | Martin K. Petersen <martin.petersen@oracle.com> | 2016-02-23 21:27:02 -0500 |
commit | 0872774d8a319676dea7416e0cf85bec63eea0d0 (patch) | |
tree | dea7ecd09b06f5de85a592bb0a90e0fcf235c000 | |
parent | 5b2e0c1befe299fbd570b1a17dec8c5aa367a623 (diff) |
lpfc: fix missing zero termination in debugfs
If you feed 32 bytes in then the kstrtoull() doesn't receive a terminated
string so will run off the end.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Reviewed-by: Johannes Thumshirn <jthumshirn@suse.de>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
-rw-r--r-- | drivers/scsi/lpfc/lpfc_debugfs.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c index 25aa9b98d53a..a63542bac153 100644 --- a/drivers/scsi/lpfc/lpfc_debugfs.c +++ b/drivers/scsi/lpfc/lpfc_debugfs.c | |||
@@ -1054,11 +1054,11 @@ lpfc_debugfs_dif_err_write(struct file *file, const char __user *buf, | |||
1054 | { | 1054 | { |
1055 | struct dentry *dent = file->f_path.dentry; | 1055 | struct dentry *dent = file->f_path.dentry; |
1056 | struct lpfc_hba *phba = file->private_data; | 1056 | struct lpfc_hba *phba = file->private_data; |
1057 | char dstbuf[32]; | 1057 | char dstbuf[33]; |
1058 | uint64_t tmp = 0; | 1058 | uint64_t tmp = 0; |
1059 | int size; | 1059 | int size; |
1060 | 1060 | ||
1061 | memset(dstbuf, 0, 32); | 1061 | memset(dstbuf, 0, 33); |
1062 | size = (nbytes < 32) ? nbytes : 32; | 1062 | size = (nbytes < 32) ? nbytes : 32; |
1063 | if (copy_from_user(dstbuf, buf, size)) | 1063 | if (copy_from_user(dstbuf, buf, size)) |
1064 | return 0; | 1064 | return 0; |