i40e: Fix off by one in i40e_dbg_command_write
authorAlan Cox <alan@linux.intel.com>
Thu, 12 Dec 2013 02:44:24 +0000 (02:44 +0000)
committerJeff Kirsher <jeffrey.t.kirsher@intel.com>
Wed, 18 Dec 2013 06:42:44 +0000 (22:42 -0800)
We assume that the resulting buffer is zero terminated when we then
re-use it. The sscanf is limited to 512 bytes but needs to be 511
to allow for a terminator.

One of a set of problems noted by Jackie Chang

Signed-off-by: Alan Cox <alan@linux.intel.com>
Acked-by: Shannon Nelson <Shannon.nelson@intel.com>
Tested-by: Kavindya Deegala <kavindya.s.deegala@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>
drivers/net/ethernet/intel/i40e/i40e_debugfs.c

index aaa2b5cc47d3b021a61438a7768fa92ad58058b5..e201060fe368a8b88dcb8bc6de978113b895b520 100644 (file)
@@ -1547,7 +1547,7 @@ static ssize_t i40e_dbg_command_write(struct file *filp,
                if (strncmp(cmd_buf, "add", 3) == 0)
                        add = true;
                cnt = sscanf(&cmd_buf[13],
-                            "%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %512s",
+                            "%hx %2hhx %2hhx %hx %2hhx %2hhx %hx %x %hd %511s",
                             &fd_data.q_index,
                             &fd_data.flex_off, &fd_data.pctype,
                             &fd_data.dest_vsi, &fd_data.dest_ctl,