1 From 97ce0a7f9caf9d715cee815a016ee21575f71c95 Mon Sep 17 00:00:00 2001
2 From: Dan Williams <dan.j.williams@gmail.com>
3 Date: Wed, 24 Sep 2008 22:48:19 -0700
4 Subject: [PATCH] md: fix input truncation in safe_delay_store()
6 safe_delay_store() currently truncates the last character of input since
7 it tells strlcpy that the buffer can only hold 'len' characters, off by
8 one. sysfs already null terminates the buffer, so just increase the
9 last argument to strlcpy.
11 Signed-off-by: Dan Williams <dan.j.williams@intel.com>
12 Signed-off-by: NeilBrown <neilb@suse.de>
14 drivers/md/md.c | 8 +++-----
15 1 file changed, 3 insertions(+), 5 deletions(-)
17 --- linux-2.6.27-SLE11_BRANCH.orig/drivers/md/md.c
18 +++ linux-2.6.27-SLE11_BRANCH/drivers/md/md.c
19 @@ -2454,12 +2454,11 @@ safe_delay_store(mddev_t *mddev, const c
25 /* remove a period, and count digits after it */
26 if (len >= sizeof(buf))
28 - strlcpy(buf, cbuf, len);
30 + strlcpy(buf, cbuf, sizeof(buf));
31 for (i=0; i<len; i++) {
33 if (isdigit(buf[i])) {
34 @@ -2472,8 +2471,7 @@ safe_delay_store(mddev_t *mddev, const c
38 - msec = simple_strtoul(buf, &e, 10);
39 - if (e == buf || (*e && *e != '\n'))
40 + if (strict_strtoul(buf, 10, &msec) < 0)
42 msec = (msec * 1000) / scale;