On Thu, Feb 13, 2025 at 12:34:55PM -0800, Bart Van Assche wrote: > Something I should have noticed earlier: this code occurs inside sysfs > write callbacks. The strings passed to sysfs write callbacks are > 0-terminated. Hence, 'buf' can be passed directly to sscanf() and > tmpbuf[] can be removed. From kernfs_fop_write_iter() in fs/kernfs.c: > > buf[len] = '\0'; /* guarantee string termination */ Oh, good point! Yeah, ignore my last email. Yes: tmpbuf can be dropped entirely. :) -- Kees Cook
