Jiale Yao <[email protected]> writes: > eeh_force_recover_write() can fill its entire stack buffer from userspace > and then pass the unterminated data to strncmp() and sscanf(). This can > make the string helpers read beyond the buffer. > > Reserve the last byte and initialize the buffer so every accepted input is > NUL-terminated. Propagate copy errors before parsing as well. > > Fixes: 954bd99435b8 ("powerpc/eeh: Add eeh_force_recover to debugfs") > Cc: [email protected] > Signed-off-by: Jiale Yao <[email protected]> > --- > arch/powerpc/kernel/eeh.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) >
Nice catch! Thanks for fixing it. LGTM, so please feel free to add: Reviewed-by: Ritesh Harjani (IBM) <[email protected]>
