diff options
| author | Hannes Reinecke <hare@suse.de> | 2021-09-06 09:04:03 +0200 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-09-26 14:10:24 +0200 |
| commit | e2860e2175c0599f9875aabca9dd582c8a5a4bc2 (patch) | |
| tree | 3946c52380b0bd8ddc3e07643e9957be1f242613 | |
| parent | da66431417408f3ca742c28974ec3e4a272f1a84 (diff) | |
nvmet: fixup buffer overrun in nvmet_subsys_attr_serial()
[ Upstream commit f04064814c2a15c22ed9c803f9b634ef34f91092 ]
The serial number is copied into the buffer via memcpy_and_pad()
with the length NVMET_SN_MAX_SIZE. So when printing out we also
need to take just that length as anything beyond that will be
uninitialized.
Signed-off-by: Hannes Reinecke <hare@suse.de>
Signed-off-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | drivers/nvme/target/configfs.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c index 273555127188..fa88bf9cba4d 100644 --- a/drivers/nvme/target/configfs.c +++ b/drivers/nvme/target/configfs.c @@ -1067,7 +1067,8 @@ static ssize_t nvmet_subsys_attr_serial_show(struct config_item *item, { struct nvmet_subsys *subsys = to_subsys(item); - return snprintf(page, PAGE_SIZE, "%s\n", subsys->serial); + return snprintf(page, PAGE_SIZE, "%*s\n", + NVMET_SN_MAX_SIZE, subsys->serial); } static ssize_t |