Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755134AbdLOJVe (ORCPT ); Fri, 15 Dec 2017 04:21:34 -0500 Received: from smtp.qindel.com ([89.140.90.34]:35991 "EHLO thor.qindel.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754516AbdLOJVb (ORCPT ); Fri, 15 Dec 2017 04:21:31 -0500 Date: Fri, 15 Dec 2017 10:21:20 +0100 (CET) From: Juan Zea To: linux-usb@vger.kernel.org Cc: shuah@kernel.org, Valentina Manea , linux-kernel@vger.kernel.org, Shuah Khan , linux-usb@vger.kernel.org Message-ID: <1908899250.1619879.1513329680276.JavaMail.zimbra@qindel.com> In-Reply-To: <3e547346-a2ec-b8b2-2d4a-25a75b068e08@osg.samsung.com> References: <204103862.1370220.1513160163538.JavaMail.zimbra@qindel.com> <473236275.1374013.1513163260837.JavaMail.zimbra@qindel.com> <7eb8f072-c4fe-92c9-a7ad-dda390b5f9db@kernel.org> <1372575371.1424549.1513247019662.JavaMail.zimbra@qindel.com> <3e547346-a2ec-b8b2-2d4a-25a75b068e08@osg.samsung.com> Subject: [PATCH] usbip: fix usbip bind writing random string after command in match_busid MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit X-Originating-IP: [172.26.0.51] X-Mailer: Zimbra 8.0.6_GA_5922 (ZimbraWebClient - FF57 (Linux)/8.0.6_GA_5922) Thread-Topic: usbip: fix usbip bind writing random string after command in match_busid Thread-Index: 2ztpuD8BVgXA96dNgVyOo/GP3r7Jxw== Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1370 Lines: 41 usbip bind writes commands followed by random string when writing to match_busid attribute in sysfs, caused by using full variable size instead of string length. Signed-off-by: Juan Zea --- tools/usb/usbip/src/utils.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/tools/usb/usbip/src/utils.c b/tools/usb/usbip/src/utils.c index 2b3d6d2..3d7b42e 100644 --- a/tools/usb/usbip/src/utils.c +++ b/tools/usb/usbip/src/utils.c @@ -30,6 +30,7 @@ int modify_match_busid(char *busid, int add) char command[SYSFS_BUS_ID_SIZE + 4]; char match_busid_attr_path[SYSFS_PATH_MAX]; int rc; + int cmd_size; snprintf(match_busid_attr_path, sizeof(match_busid_attr_path), "%s/%s/%s/%s/%s/%s", SYSFS_MNT_PATH, SYSFS_BUS_NAME, @@ -37,12 +38,14 @@ int modify_match_busid(char *busid, int add) attr_name); if (add) - snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", busid); + cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "add %s", + busid); else - snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", busid); + cmd_size = snprintf(command, SYSFS_BUS_ID_SIZE + 4, "del %s", + busid); rc = write_sysfs_attribute(match_busid_attr_path, command, - sizeof(command)); + cmd_size); if (rc < 0) { dbg("failed to write match_busid: %s", strerror(errno)); return -1; -- 2.7.4