Jiale Yao [off-list ref] writes:
eeh_force_recover_write() can fill its entire stack buffer from userspace
and then pass the unterminated data to strncmp() and sscanf(). This can
make the string helpers read beyond the buffer.
Reserve the last byte and initialize the buffer so every accepted input is
NUL-terminated. Propagate copy errors before parsing as well.
Fixes: 954bd99435b8 ("powerpc/eeh: Add eeh_force_recover to debugfs")
Cc: <redacted>
Signed-off-by: Jiale Yao <redacted>
---
arch/powerpc/kernel/eeh.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
Nice catch! Thanks for fixing it.
LGTM, so please feel free to add:
Reviewed-by: Ritesh Harjani (IBM) <ritesh.list@gmail.com>