diff mbox series

zram: off by one in read_block_state()

Message ID 20210916130404.GA25094@kili (mailing list archive)
State New, archived
Headers show
Series zram: off by one in read_block_state() | expand

Commit Message

Dan Carpenter Sept. 16, 2021, 1:04 p.m. UTC 
The snprintf() function returns the number of bytes it would have
printed if there were space.  But it does not count the NUL terminator.
So that means that if "count == copied" then this has already
overflowed by one character.

This bug likely isn't super harmful in real life.

Fixes: c0265342bff4 ("zram: introduce zram memory tracking")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/block/zram/zram_drv.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
index fcaf2750f68f..6383c81ac5b3 100644
--- a/drivers/block/zram/zram_drv.c
+++ b/drivers/block/zram/zram_drv.c
@@ -910,7 +910,7 @@  static ssize_t read_block_state(struct file *file, char __user *buf,
 			zram_test_flag(zram, index, ZRAM_HUGE) ? 'h' : '.',
 			zram_test_flag(zram, index, ZRAM_IDLE) ? 'i' : '.');
 
-		if (count < copied) {
+		if (count <= copied) {
 			zram_slot_unlock(zram, index);
 			break;
 		}