From: Sayali Lokhande Date: Fri, 17 Nov 2017 04:57:18 +0000 (+0530) Subject: scsi: ufs: Fix off-by-one bug in ufs debugfs driver X-Git-Url: http://git.osdn.net/view?a=commitdiff_plain;h=db50a405c22a414aeb4a03ef3a167cdcbb202f58;p=sagit-ice-cold%2Fkernel_xiaomi_msm8998.git scsi: ufs: Fix off-by-one bug in ufs debugfs driver When getting string from userspace by simple_write_to_buffer in ufs_qcom_dbg_testbus_cfg_write() function, null byte may be written out of bounds of configuration buffer if return value is same as size of buffer, causing off-by-one bug. This change passes correct available size of configuration buffer to simple_write_to_buffer function. Change-Id: If6085e806aa34622a9a57b02f563869c51011d2f Signed-off-by: Sayali Lokhande --- diff --git a/drivers/scsi/ufs/ufs-qcom-debugfs.c b/drivers/scsi/ufs/ufs-qcom-debugfs.c index 494ecd1c5f79..db4ecec6cf2f 100644 --- a/drivers/scsi/ufs/ufs-qcom-debugfs.c +++ b/drivers/scsi/ufs/ufs-qcom-debugfs.c @@ -121,7 +121,8 @@ static ssize_t ufs_qcom_dbg_testbus_cfg_write(struct file *file, struct ufs_hba *hba = host->hba; - ret = simple_write_to_buffer(configuration, TESTBUS_CFG_BUFF_LINE_SIZE, + ret = simple_write_to_buffer(configuration, + TESTBUS_CFG_BUFF_LINE_SIZE - 1, &buff_pos, ubuf, cnt); if (ret < 0) { dev_err(host->hba->dev, "%s: failed to read user data\n",