Thanks for the fix, applied to drm-misc-fixes
On 5/8/2025 3:06 PM, Markus Burri wrote:
> Use the effective written size instead of original size as index for zero
> termination. If the input from user-space is to larger and the input is
> truncated, the original size is out-of-bound.
> Since there is an upfront size check here, the change is for consistency.
>
> Signed-off-by: Markus Burri <markus.bu...@mt.com>
> ---
> drivers/accel/ivpu/ivpu_debugfs.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/drivers/accel/ivpu/ivpu_debugfs.c
> b/drivers/accel/ivpu/ivpu_debugfs.c
> index f0dad0c9ce33..cd24ccd20ba6 100644
> --- a/drivers/accel/ivpu/ivpu_debugfs.c
> +++ b/drivers/accel/ivpu/ivpu_debugfs.c
> @@ -455,7 +455,7 @@ priority_bands_fops_write(struct file *file, const char
> __user *user_buf, size_t
> if (ret < 0)
> return ret;
>
> - buf[size] = '\0';
> + buf[ret] = '\0';
> ret = sscanf(buf, "%u %u %u %u", &band, &grace_period,
> &process_grace_period,
> &process_quantum);
> if (ret != 4)
