scsi: qedi: Fix truncation of CHAP name and secret

The data in NVRAM is not guaranteed to be NUL terminated.  Since
snprintf expects byte-stream to accommodate null byte, the CHAP secret
is truncated.  Use sprintf instead of snprintf to fix the truncation of
CHAP name and secret.

Signed-off-by: Andrew Vasquez <andrew.vasquez@cavium.com>
Signed-off-by: Nilesh Javali <nilesh.javali@cavium.com>
Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>
Acked-by: Chris Leech <cleech@redhat.com>
Acked-by: Lee Duncan <lduncan@suse.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

1 files changed, 12 insertions, 12 deletions

diff --git a/drivers/scsi/qedi/qedi_main.c b/drivers/scsi/qedi/qedi_main.c
index 58596d17f7d9..7c05be680b94 100644
--- a/drivers/scsi/qedi/qedi_main.c
+++ b/drivers/scsi/qedi/qedi_main.c
@@ -1830,8 +1830,8 @@ static ssize_t qedi_show_boot_ini_info(void *data, int type, char *buf)
 
         switch (type) {
         case ISCSI_BOOT_INI_INITIATOR_NAME:
-                rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
-                              initiator->initiator_name.byte);
+                rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
+                             initiator->initiator_name.byte);
                 break;
         default:
                 rc = 0;
@@ -1898,8 +1898,8 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type,
 
         switch (type) {
         case ISCSI_BOOT_TGT_NAME:
-                rc = snprintf(str, NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN, "%s\n",
-                              block->target[idx].target_name.byte);
+                rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_ISCSI_NAME_MAX_LEN,
+                             block->target[idx].target_name.byte);
                 break;
         case ISCSI_BOOT_TGT_IP_ADDR:
                 if (ipv6_en)
@@ -1920,20 +1920,20 @@ qedi_show_boot_tgt_info(struct qedi_ctx *qedi, int type,
                               block->target[idx].lun.value[0]);
                 break;
         case ISCSI_BOOT_TGT_CHAP_NAME:
-                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
-                              chap_name);
+                rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
+                             chap_name);
                 break;
         case ISCSI_BOOT_TGT_CHAP_SECRET:
-                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
-                              chap_secret);
+                rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
+                             chap_secret);
                 break;
         case ISCSI_BOOT_TGT_REV_CHAP_NAME:
-                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN, "%s\n",
-                              mchap_name);
+                rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
+                             mchap_name);
                 break;
         case ISCSI_BOOT_TGT_REV_CHAP_SECRET:
-                rc = snprintf(str, NVM_ISCSI_CFG_CHAP_PWD_MAX_LEN, "%s\n",
-                              mchap_secret);
+                rc = sprintf(str, "%.*s\n", NVM_ISCSI_CFG_CHAP_NAME_MAX_LEN,
+                             mchap_secret);
                 break;
         case ISCSI_BOOT_TGT_FLAGS:
                 rc = snprintf(str, 3, "%hhd\n", SYSFS_FLAG_FW_SEL_BOOT);