Commit 5561b6a1 authored by Alan Cox's avatar Alan Cox Committed by Jeff Kirsher

i40e: Fix off by one in i40e_dbg_command_write

We assume that the resulting buffer is zero terminated when we then
re-use it. The sscanf is limited to 512 bytes but needs to be 511
to allow for a terminator.

One of a set of problems noted by Jackie Chang
Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Acked-by: default avatarShannon Nelson <Shannon.nelson@intel.com>
Tested-by: default avatarKavindya Deegala <kavindya.s.deegala@intel.com>
Signed-off-by: default avatarJeff Kirsher <jeffrey.t.kirsher@intel.com>
parent 582a74e5
......@@ -1547,7 +1547,7 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
if (strncmp(cmd_buf, "add", 3) == 0)
add = true;
cnt = sscanf(&cmd_buf[13],
"%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %512s",
"%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %511s",
&fd_data.q_index,
&fd_data.flex_off, &fd_data.pctype,
&fd_data.dest_vsi, &fd_data.dest_ctl,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment