From 1fe88b1741ff655bb59e4fd78178fe2c557b9185 Mon Sep 17 00:00:00 2001 From: Jiale Yao Date: Sat, 26 Sep 2026 20:12:48 +0800 Subject: [PATCH] platform/olpc: Reserve space for a string terminator MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ec_dbgfs_cmd_write() copies user input into a zero-initialized stack buffer and passes it to sscanf(). A write that overwrites the entire buffer leaves no terminator, so the subsequent parsing can read beyond the buffer. Limit the copy to leave room for the trailing NUL. Fixes: 6cca83d498bd ("Platform: OLPC: move debugfs support from x86 EC driver") Signed-off-by: Jiale Yao Link: https://patch.msgid.link/20260926121250.3258285-2-yaojiale02@163.com Reviewed-by: Ilpo Järvinen Signed-off-by: Ilpo Järvinen --- drivers/platform/olpc/olpc-ec.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/olpc/olpc-ec.c b/drivers/platform/olpc/olpc-ec.c index 4a2d36f7331e..063f7e55c421 100644 --- a/drivers/platform/olpc/olpc-ec.c +++ b/drivers/platform/olpc/olpc-ec.c @@ -269,7 +269,7 @@ static ssize_t ec_dbgfs_cmd_write(struct file *file, const char __user *buf, mutex_lock(&ec_dbgfs_lock); - size = simple_write_to_buffer(cmdbuf, sizeof(cmdbuf), ppos, buf, size); + size = simple_write_to_buffer(cmdbuf, sizeof(cmdbuf) - 1, ppos, buf, size); m = sscanf(cmdbuf, "%x:%u %x %x %x %x %x", &ec_cmd_int[0], &ec_dbgfs_resp_bytes, &ec_cmd_int[1], &ec_cmd_int[2],