psi_write() copies at most 32 bytes of the write into its buffer and
terminates the buffer by overwriting its last byte. For a write shorter
than 32 bytes that is the last byte the writer sent. A trigger written
without a trailing newline loses its last digit then, "some 150000
1000000" turns into "some 150000 100000", and a shorter one like
"some 150 10000" fails with -EINVAL because the window doesn't fit
anymore. Only writes that end in a newline parse as intended.
Copy at most 31 bytes and terminate behind them.
Fixes: 0e94682b73bf ("psi: introduce psi monitor")
Cc: [email protected]
Signed-off-by: Christian Brauner (Amutable) <[email protected]>
---
kernel/sched/psi.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/kernel/sched/psi.c b/kernel/sched/psi.c
index 7c5381423334..8b59635e95d4 100644
--- a/kernel/sched/psi.c
+++ b/kernel/sched/psi.c
@@ -1566,11 +1566,11 @@ static ssize_t psi_write(struct file *file, const char
__user *user_buf,
if (!nbytes)
return -EINVAL;
- buf_size = min(nbytes, sizeof(buf));
+ buf_size = min(nbytes, sizeof(buf) - 1);
if (copy_from_user(buf, user_buf, buf_size))
return -EFAULT;
- buf[buf_size - 1] = '\0';
+ buf[buf_size] = '\0';
seq = file->private_data;
--
2.53.0
