# \[PATCH RFC 13/38\] scsi: core: NUL-terminate what is written to the host proc files - From: Christian Brauner \ - Date: 2026-11-02 14:24:48 - List: linux-modules - Page: https://ratatoskr.run/linux-modules/2026/11/17844931 - Thread: https://ratatoskr.run/linux-fsdevel/2026/11/17844895/t.md ```text proc_scsi_host_write() copies what is written into a page and hands it to ->write_info() without terminating it. ppa and imm parse it with strncmp() and simple_strtoul(), which read on past what was written into whatever the page held before. Terminate the copy. A write is at most PROC_BLOCK_SIZE bytes, so the page always has room for that. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: Signed-off-by: Christian Brauner (Amutable) --- drivers/scsi/scsi_proc.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/scsi/scsi_proc.c b/drivers/scsi/scsi_proc.c index fdc355d783da..dbd03360b5a4 100644 --- a/drivers/scsi/scsi_proc.c +++ b/drivers/scsi/scsi_proc.c @@ -80,6 +80,7 @@ static ssize_t proc_scsi_host_write(struct file *file, const char __user *buf, ret = -EFAULT; if (copy_from_user(page, buf, count)) goto out; + page[count] = '\0'; ret = shost->hostt->write_info(shost, page, count); } out: -- 2.53.0 ```