Skip to content

Commit

Permalink
i40e: Fix off by one in i40e_dbg_command_write
Browse files Browse the repository at this point in the history
We assume that the resulting buffer is zero terminated when we then
re-use it. The sscanf is limited to 512 bytes but needs to be 511
to allow for a terminator.

One of a set of problems noted by Jackie Chang

Signed-off-by: Alan Cox <alan@linux.intel.com>
Acked-by: Shannon Nelson <Shannon.nelson@intel.com>
Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
  • Loading branch information
Alan Cox authored and Jeff Kirsher committed Dec 18, 2013
1 parent 582a74e commit 5561b6a
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/net/ethernet/intel/i40e/i40e_debugfs.c
Original file line number Diff line number Diff line change
Expand Up @@ -1547,7 +1547,7 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
if (strncmp(cmd_buf, "add", 3) == 0)
add = true;
cnt = sscanf(&cmd_buf[13],
"%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %512s",
"%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %511s",
&fd_data.q_index,
&fd_data.flex_off, &fd_data.pctype,
&fd_data.dest_vsi, &fd_data.dest_ctl,
Expand Down

0 comments on commit 5561b6a

Please sign in to comment.