提交 5561b6a1 编写于 作者: A Alan Cox 提交者: Jeff Kirsher

i40e: Fix off by one in i40e_dbg_command_write

We assume that the resulting buffer is zero terminated when we then
re-use it. The sscanf is limited to 512 bytes but needs to be 511
to allow for a terminator.

One of a set of problems noted by Jackie Chang
Signed-off-by: NAlan Cox <alan@linux.intel.com>
Acked-by: NShannon Nelson <Shannon.nelson@intel.com>
Tested-by: NKavindya Deegala <kavindya.s.deegala@intel.com>
Signed-off-by: NJeff Kirsher <jeffrey.t.kirsher@intel.com>
上级 582a74e5
......@@ -1547,7 +1547,7 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
if (strncmp(cmd_buf, "add", 3) == 0)
add = true;
cnt = sscanf(&cmd_buf[13],
"%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %512s",
"%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %511s",
&fd_data.q_index,
&fd_data.flex_off, &fd_data.pctype,
&fd_data.dest_vsi, &fd_data.dest_ctl,
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册