summaryrefslogtreecommitdiffstats
path: root/tools/usb/usbip
diff options
context:
space:
mode:
authorJuan Zea <juan.zea@qindel.com>2017-12-15 10:21:20 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2017-12-19 11:40:55 +0100
commit544c4605acc5ae4afe7dd5914147947db182f2fb (patch)
tree75bb4c70d73b0cc4cf56e09076551cbbdb466bb6 /tools/usb/usbip
parent10c90120930628e8b959bf58d4a0aaef3ae5d945 (diff)
downloadlinux-544c4605acc5ae4afe7dd5914147947db182f2fb.tar.gz
linux-544c4605acc5ae4afe7dd5914147947db182f2fb.tar.bz2
linux-544c4605acc5ae4afe7dd5914147947db182f2fb.zip
usbip: fix usbip bind writing random string after command in match_busid
usbip bind writes commands followed by random string when writing to match_busid attribute in sysfs, caused by using full variable size instead of string length. Signed-off-by: Juan Zea <juan.zea@qindel.com> Acked-by: Shuah Khan <shuahkh@osg.samsung.com> Cc: stable <stable@vger.kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'tools/usb/usbip')
-rw-r--r--tools/usb/usbip/src/utils.c9
1 files changed, 6 insertions, 3 deletions
diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c
index 2b3d6d235015..3d7b42e77299 100644
--- a/tools/usb/usbip/src/utils.c
+++ b/tools/usb/usbip/src/utils.c
@@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add)
char command[SYSFS_BUS_ID_SIZE + 4];
char match_busid_attr_path[SYSFS_PATH_MAX];
int rc;
+ int cmd_size;
snprintf(match_busid_attr_path, sizeof(match_busid_attr_path),
"%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME,
@@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add)
attr_name);
if (add)
- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid);
+ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s",
+ busid);
else
- snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid);
+ cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s",
+ busid);
rc = write_sysfs_attribute(match_busid_attr_path, command,
- sizeof(command));
+ cmd_size);
if (rc < 0) {
dbg("failed to write match_busid: %s", strerror(errno));
return -1;