--- /dev/null
+From 0bd46e22c5ec3dbfb81b60de475151e3f6b411c2 Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 9 Sep 2021 12:14:40 +0300
+Subject: nvmet: fix a width vs precision bug in nvmet_subsys_attr_serial_show()
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 0bd46e22c5ec3dbfb81b60de475151e3f6b411c2 upstream.
+
+This was intended to limit the number of characters printed from
+"subsys->serial" to NVMET_SN_MAX_SIZE. But accidentally the width
+specifier was used instead of the precision specifier so it only
+affects the alignment and not the number of characters printed.
+
+Fixes: f04064814c2a ("nvmet: fixup buffer overrun in nvmet_subsys_attr_serial()")
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/nvme/target/configfs.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/nvme/target/configfs.c
++++ b/drivers/nvme/target/configfs.c
+@@ -1067,7 +1067,7 @@ static ssize_t nvmet_subsys_attr_serial_
+ {
+ struct nvmet_subsys *subsys = to_subsys(item);
+
+- return snprintf(page, PAGE_SIZE, "%*s\n",
++ return snprintf(page, PAGE_SIZE, "%.*s\n",
+ NVMET_SN_MAX_SIZE, subsys->serial);
+ }
+