diff options
| author | Sayali Lokhande <sayalil@codeaurora.org> | 2017-11-17 10:27:18 +0530 |
|---|---|---|
| committer | Sayali Lokhande <sayalil@codeaurora.org> | 2017-11-21 08:34:42 +0530 |
| commit | db50a405c22a414aeb4a03ef3a167cdcbb202f58 (patch) | |
| tree | 10760b108771938f4100c3c4703889211283f863 /drivers | |
| parent | ae2f6cb5ada42a3e3da6182ac3092007f5a319d8 (diff) | |
scsi: ufs: Fix off-by-one bug in ufs debugfs driver
When getting string from userspace by simple_write_to_buffer
in ufs_qcom_dbg_testbus_cfg_write() function, null byte may
be written out of bounds of configuration buffer if return
value is same as size of buffer, causing off-by-one bug.
This change passes correct available size of configuration
buffer to simple_write_to_buffer function.
Change-Id: If6085e806aa34622a9a57b02f563869c51011d2f
Signed-off-by: Sayali Lokhande <sayalil@codeaurora.org>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/scsi/ufs/ufs-qcom-debugfs.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/scsi/ufs/ufs-qcom-debugfs.c b/drivers/scsi/ufs/ufs-qcom-debugfs.c index 494ecd1c5f79..db4ecec6cf2f 100644 --- a/drivers/scsi/ufs/ufs-qcom-debugfs.c +++ b/drivers/scsi/ufs/ufs-qcom-debugfs.c @@ -121,7 +121,8 @@ static ssize_t ufs_qcom_dbg_testbus_cfg_write(struct file *file, struct ufs_hba *hba = host->hba; - ret = simple_write_to_buffer(configuration, TESTBUS_CFG_BUFF_LINE_SIZE, + ret = simple_write_to_buffer(configuration, + TESTBUS_CFG_BUFF_LINE_SIZE - 1, &buff_pos, ubuf, cnt); if (ret < 0) { dev_err(host->hba->dev, "%s: failed to read user data\n", |