diff mbox series

scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()

Message ID 20211214070527.GA27934@kili (mailing list archive)
State Accepted
Headers show
Series scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write() | expand

Commit Message

Dan Carpenter Dec. 14, 2021, 7:05 a.m. UTC
The "mybuf" string comes from the user, so we need to ensure that it is
NUL terminated.

Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
---
 drivers/scsi/lpfc/lpfc_debugfs.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

James Smart Dec. 14, 2021, 3:10 p.m. UTC | #1
On 12/13/2021 11:05 PM, Dan Carpenter wrote:
> The "mybuf" string comes from the user, so we need to ensure that it is
> NUL terminated.
> 
> Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs support")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>   drivers/scsi/lpfc/lpfc_debugfs.c | 4 ++--
>   1 file changed, 2 insertions(+), 2 deletions(-)
> 

Thanks Dan. Looks Good.

Reviewed-by: James Smart <jsmart2021@gmail.com>

-- james
Martin K. Petersen Dec. 17, 2021, 4:04 a.m. UTC | #2
On Tue, 14 Dec 2021 10:05:27 +0300, Dan Carpenter wrote:

> The "mybuf" string comes from the user, so we need to ensure that it is
> NUL terminated.
> 
> 

Applied to 5.16/scsi-fixes, thanks!

[1/1] scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
      https://git.kernel.org/mkp/scsi/c/9020be114a47
Martin K. Petersen Dec. 23, 2021, 5:08 a.m. UTC | #3
On Tue, 14 Dec 2021 10:05:27 +0300, Dan Carpenter wrote:

> The "mybuf" string comes from the user, so we need to ensure that it is
> NUL terminated.
> 
> 

Applied to 5.16/scsi-fixes, thanks!

[1/1] scsi: lpfc: Terminate string in lpfc_debugfs_nvmeio_trc_write()
      https://git.kernel.org/mkp/scsi/c/9020be114a47
James Bottomley Dec. 31, 2021, 2:55 p.m. UTC | #4
On Tue, 2021-12-14 at 10:05 +0300, Dan Carpenter wrote:
> The "mybuf" string comes from the user, so we need to ensure that it
> is NUL terminated.
> 
> Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs
> support")
> Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> ---
>  drivers/scsi/lpfc/lpfc_debugfs.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c
> b/drivers/scsi/lpfc/lpfc_debugfs.c
> index 21152c9a96ef..30fac2f6fb06 100644
> --- a/drivers/scsi/lpfc/lpfc_debugfs.c
> +++ b/drivers/scsi/lpfc/lpfc_debugfs.c
> @@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file
> *file, const char __user *buf,
>  	char mybuf[64];
>  	char *pbuf;
>  
> -	if (nbytes > 64)
> -		nbytes = 64;
> +	if (nbytes > 63)
> +		nbytes = 63;

Just for future reference, next time could we do

if (nbytes > sizeof(mybuf) - 1)
        nbytes = sizeof(mybuf) - 1;

just so we minimize the possibility of screw ups in the unlikely event
that someone reduces the size of the mybuf array?

James
Dan Carpenter Jan. 7, 2022, 9:31 a.m. UTC | #5
On Fri, Dec 31, 2021 at 09:55:00AM -0500, James Bottomley wrote:
> On Tue, 2021-12-14 at 10:05 +0300, Dan Carpenter wrote:
> > The "mybuf" string comes from the user, so we need to ensure that it
> > is NUL terminated.
> > 
> > Fixes: bd2cdd5e400f ("scsi: lpfc: NVME Initiator: Add debugfs
> > support")
> > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> > ---
> >  drivers/scsi/lpfc/lpfc_debugfs.c | 4 ++--
> >  1 file changed, 2 insertions(+), 2 deletions(-)
> > 
> > diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c
> > b/drivers/scsi/lpfc/lpfc_debugfs.c
> > index 21152c9a96ef..30fac2f6fb06 100644
> > --- a/drivers/scsi/lpfc/lpfc_debugfs.c
> > +++ b/drivers/scsi/lpfc/lpfc_debugfs.c
> > @@ -2954,8 +2954,8 @@ lpfc_debugfs_nvmeio_trc_write(struct file
> > *file, const char __user *buf,
> >  	char mybuf[64];
> >  	char *pbuf;
> >  
> > -	if (nbytes > 64)
> > -		nbytes = 64;
> > +	if (nbytes > 63)
> > +		nbytes = 63;
> 
> Just for future reference, next time could we do
> 
> if (nbytes > sizeof(mybuf) - 1)
>         nbytes = sizeof(mybuf) - 1;
> 
> just so we minimize the possibility of screw ups in the unlikely event
> that someone reduces the size of the mybuf array?

Yeah.  Good point.  Will do that next time.

regards,
dan carpenter
diff mbox series

Patch

diff --git a/drivers/scsi/lpfc/lpfc_debugfs.c b/drivers/scsi/lpfc/lpfc_debugfs.c
index 21152c9a96ef..30fac2f6fb06 100644
--- a/drivers/scsi/lpfc/lpfc_debugfs.c
+++ b/drivers/scsi/lpfc/lpfc_debugfs.c
@@ -2954,8 +2954,8 @@  lpfc_debugfs_nvmeio_trc_write(struct file *file, const char __user *buf,
 	char mybuf[64];
 	char *pbuf;
 
-	if (nbytes > 64)
-		nbytes = 64;
+	if (nbytes > 63)
+		nbytes = 63;
 
 	memset(mybuf, 0, sizeof(mybuf));