Patch "RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()" has been added to the 6.7-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()

to the 6.7-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     rdma-rtrs-clt-check-strnlen-return-len-in-sysfs-mpat.patch
and it can be found in the queue-6.7 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c8f0e442e710aa4a21c8316e4a26e45fc26648ab
Author: Alexey Kodanev <aleksei.kodanev@xxxxxxxxxxx>
Date:   Wed Feb 21 11:32:04 2024 +0000

    RDMA/rtrs-clt: Check strnlen return len in sysfs mpath_policy_store()
    
    [ Upstream commit 7a7b7f575a25aa68ee934ee8107294487efcb3fe ]
    
    strnlen() may return 0 (e.g. for "\0\n" string), it's better to
    check the result of strnlen() before using 'len - 1' expression
    for the 'buf' array index.
    
    Detected using the static analysis tool - Svace.
    
    Fixes: dc3b66a0ce70 ("RDMA/rtrs-clt: Add a minimum latency multipath policy")
    Signed-off-by: Alexey Kodanev <aleksei.kodanev@xxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20240221113204.147478-1-aleksei.kodanev@xxxxxxxxxxx
    Acked-by: Jack Wang <jinpu.wang@xxxxxxxxx>
    Signed-off-by: Leon Romanovsky <leon@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
index d3c436ead6946..4aa80c9388f05 100644
--- a/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
+++ b/drivers/infiniband/ulp/rtrs/rtrs-clt-sysfs.c
@@ -133,7 +133,7 @@ static ssize_t mpath_policy_store(struct device *dev,
 
 	/* distinguish "mi" and "min-latency" with length */
 	len = strnlen(buf, NAME_MAX);
-	if (buf[len - 1] == '\n')
+	if (len && buf[len - 1] == '\n')
 		len--;
 
 	if (!strncasecmp(buf, "round-robin", 11) ||




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux