Seems something wrong
when size = SB_LABEL_SIZE and u->label[size - 1] != '\n'
please check again.
---------------------------------------------------------------------------
Tang Junhui
Forever me is me
---------------------------------------------------------------------------
Dongbo Cao <cdbdyx@xxxxxxx> 于2018年9月14日周五 下午6:13写道：
>
> do some checks on the label's length and ending.
>
> Signed-off-by: Dongbo Cao <cdbdyx@xxxxxxx>
> ---
> drivers/md/bcache/sysfs.c | 9 ++++++++-
> 1 file changed, 8 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/md/bcache/sysfs.c b/drivers/md/bcache/sysfs.c
> index e64c718f..cce793ef 100644
> --- a/drivers/md/bcache/sysfs.c
> +++ b/drivers/md/bcache/sysfs.c
> @@ -447,8 +447,15 @@ STORE(__bch_flash_dev)
> }
>
> if (attr == &sysfs_label) {
> + if (size > SB_LABEL_SIZE)
> + return -EINVAL;
> memcpy(u->label, buf, SB_LABEL_SIZE);
> - bch_uuid_write(d->c);
> + if (size < SB_LABEL_SIZE)
> + u->label[size] = '\0';
> + if (size && u->label[size - 1] == '\n')
> + u->label[size - 1] = '\0';
> + if(d->c)
> + bch_uuid_write(d->c);
> }
>
> if (attr == &sysfs_unregister) {
> --
> 2.17.1
>
>
