Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5561b6a1 authored by Alan Cox's avatar Alan Cox Committed by Jeff Kirsher
Browse files

i40e: Fix off by one in i40e_dbg_command_write 



We assume that the resulting buffer is zero terminated when we then
re-use it. The sscanf is limited to 512 bytes but needs to be 511
to allow for a terminator.

One of a set of problems noted by Jackie Chang

Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Acked-by: default avatarShannon Nelson <Shannon.nelson@intel.com>
Tested-by: default avatarKavindya Deegala <kavindya.s.deegala@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent 582a74e5

drivers/net/ethernet/intel/i40e/i40e_debugfs.c

+1 −1
Original line number Diff line number Diff line
@@ -1547,7 +1547,7 @@ static ssize_t i40e_dbg_command_write(struct file *filp, 
		if (strncmp(cmd_buf, "add", 3) == 0)

			add = true;

		cnt = sscanf(&cmd_buf[13],

			     "%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %512s",

			     "%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %511s",

			     &fd_data.q_index,

			     &fd_data.flex_off, &fd_data.pctype,

			     &fd_data.dest_vsi, &fd_data.dest_ctl,