evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

scsi: ufs: Fix off-by-one bug in ufs debugfs driver

Browse source 
When getting string from userspace by simple_write_to_buffer
in ufs_qcom_dbg_testbus_cfg_write() function, null byte may
be written out of bounds of configuration buffer if return
value is same as size of buffer, causing off-by-one bug.
This change passes correct available size of configuration
buffer to simple_write_to_buffer function.

Change-Id: If6085e806aa34622a9a57b02f563869c51011d2f
Signed-off-by: Sayali Lokhande <sayalil@codeaurora.org>
This commit is contained in:
Sayali Lokhande 2017-11-17 10:27:18 +05:30
parent ae2f6cb5ad
commit db50a405c2
1 changed files with 2 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

3
drivers/scsi/ufs/ufs-qcom-debugfs.c
View file

@ -121,7 +121,8 @@ static ssize_t ufs_qcom_dbg_testbus_cfg_write(struct file *file,
struct ufs_hba *hba = host->hba;
ret = simple_write_to_buffer(configuration, TESTBUS_CFG_BUFF_LINE_SIZE,
ret = simple_write_to_buffer(configuration,
TESTBUS_CFG_BUFF_LINE_SIZE - 1,
&buff_pos, ubuf, cnt);
if (ret < 0) {
dev_err(host->hba->dev, "%s: failed to read user data\n",