On Wed, Aug 08, 2018 at 03:31:00PM -0700, Peter Kalauskas wrote:
> The call to strlcpy in backing_dev_store is incorrect. It should take
> the size of the destination buffer instead of the size of the source
> buffer. Additionally, ignore the newline character (\n) when reading
> the new file_name buffer. This makes it possible to set the backing_dev
> as follows:
>
> echo /dev/sdX > /sys/block/zram0/backing_dev
>
> Signed-off-by: Peter Kalauskas <pes...@google.com>
Acked-by: Minchan Kim <minc...@kernel.org>
Cc: Andrew Morton <a...@linux-foundation.org>
Cc: Sergey Senozhatsky <sergey.senozhatsky.w...@gmail.com>
CC: LKML <linux-kernel@vger.kernel.org>
Cc: <sta...@vger.kernel.org> [4.14+]
> ---
> drivers/block/zram/zram_drv.c | 7 ++++++-
> 1 file changed, 6 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/block/zram/zram_drv.c b/drivers/block/zram/zram_drv.c
> index 7436b2d27fa3..3137faea1493 100644
> --- a/drivers/block/zram/zram_drv.c
> +++ b/drivers/block/zram/zram_drv.c
> @@ -336,6 +336,7 @@ static ssize_t backing_dev_store(struct device *dev,
> struct device_attribute *attr, const char *buf, size_t len)
> {
> char *file_name;
> + size_t sz;
> struct file *backing_dev = NULL;
> struct inode *inode;
> struct address_space *mapping;
> @@ -356,7 +357,11 @@ static ssize_t backing_dev_store(struct device *dev,
> goto out;
> }
>
> - strlcpy(file_name, buf, len);
> + strlcpy(file_name, buf, PATH_MAX);
> + /* ignore trailing newline */
> + sz = strlen(file_name);
> + if (sz > 0 && file_name[sz - 1] == '\n')
> + file_name[sz - 1] = 0x00;
>
> backing_dev = filp_open(file_name, O_RDWR|O_LARGEFILE, 0);
> if (IS_ERR(backing_dev)) {
> --
> 2.18.0.597.ga71716f1ad-goog
>
