Commit 97ce0a7f authored by Dan Williams's avatar Dan Williams Committed by NeilBrown

md: fix input truncation in safe_delay_store()

safe_delay_store() currently truncates the last character of input since
it tells strlcpy that the buffer can only hold 'len' characters, off by
one.  sysfs already null terminates the buffer, so just increase the
last argument to strlcpy.
Signed-off-by: default avatarDan Williams <dan.j.williams@intel.com>
Signed-off-by: default avatarNeilBrown <neilb@suse.de>
parent 08ff39f1
...@@ -2394,12 +2394,11 @@ safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len) ...@@ -2394,12 +2394,11 @@ safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len)
int i; int i;
unsigned long msec; unsigned long msec;
char buf[30]; char buf[30];
char *e;
/* remove a period, and count digits after it */ /* remove a period, and count digits after it */
if (len >= sizeof(buf)) if (len >= sizeof(buf))
return -EINVAL; return -EINVAL;
strlcpy(buf, cbuf, len); strlcpy(buf, cbuf, sizeof(buf));
buf[len] = 0;
for (i=0; i<len; i++) { for (i=0; i<len; i++) {
if (dot) { if (dot) {
if (isdigit(buf[i])) { if (isdigit(buf[i])) {
...@@ -2412,8 +2411,7 @@ safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len) ...@@ -2412,8 +2411,7 @@ safe_delay_store(mddev_t *mddev, const char *cbuf, size_t len)
buf[i] = 0; buf[i] = 0;
} }
} }
msec = simple_strtoul(buf, &e, 10); if (strict_strtoul(buf, 10, &msec) < 0)
if (e == buf || (*e && *e != '\n'))
return -EINVAL; return -EINVAL;
msec = (msec * 1000) / scale; msec = (msec * 1000) / scale;
if (msec == 0) if (msec == 0)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment