UBI: improve mkvol request validation

Check that volume name is not shorter than 'name_len'.

No need to copy the trailing zero byte because whole array
was zeroed earlier.

Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>

1 files changed, 5 insertions, 2 deletions

diff --git a/drivers/mtd/ubi/cdev.c b/drivers/mtd/ubi/cdev.c
index 3e3449ec07f0..4fb84e3e6502 100644
--- a/drivers/mtd/ubi/cdev.c
+++ b/drivers/mtd/ubi/cdev.c
@@ -574,6 +574,10 @@ static int verify_mkvol_req(const struct ubi_device *ubi,
                 goto bad;
         }
 
+        n = strnlen(req->name, req->name_len + 1);
+        if (n != req->name_len)
+                goto bad;
+
         return 0;
 
 bad:
@@ -629,12 +633,11 @@ static int ubi_cdev_ioctl(struct inode *inode, struct file *file,
                         break;
                 }
 
+                req.name[req.name_len] = '\0';
                 err = verify_mkvol_req(ubi, &req);
                 if (err)
                         break;
 
-                req.name[req.name_len] = '\0';
-
                 mutex_lock(&ubi->volumes_mutex);
                 err = ubi_create_volume(ubi, &req);
                 mutex_unlock(&ubi->volumes_mutex);