Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

scsi: ufs: Fix off-by-one bug in ufs debugfs driver 

When getting string from userspace by simple_write_to_buffer
in ufs_qcom_dbg_testbus_cfg_write() function, null byte may
be written out of bounds of configuration buffer if return
value is same as size of buffer, causing off-by-one bug.
This change passes correct available size of configuration
buffer to simple_write_to_buffer function.

Change-Id: I99d4223ba7ac191e7a931c1c0c7be8bcda6263a6
CRs-Fixed: 2143495
Signed-off-by: Yasir Malik <ymalik@codeaurora.org>
Signed-off-by: Sayali Lokhande <sayalil@codeaurora.org>
This commit is contained in:
Yasir Malik 2017-11-30 16:17:12 -05:00 committed by Gerrit - the friendly Code Review server
parent a7f91bc99c
commit 438657bc78
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/scsi/ufs/qcom-debugfs.c
View File

@ -113,7 +113,8 @@ static ssize_t ufs_qcom_dbg_testbus_cfg_write(struct file *file,
unsigned long flags;
struct ufs_hba *hba = host->hba;
cnt = simple_write_to_buffer(configuration, TESTBUS_CFG_BUFF_LINE_SIZE,
cnt = simple_write_to_buffer(configuration,
TESTBUS_CFG_BUFF_LINE_SIZE - 1,
&buff_pos, ubuf, cnt);
if (cnt < 0) {
dev_err(host->hba->dev, "%s: failed to read user data\n",