| From c8bd134a4bddafe5917d163eea73873932c15e83 Mon Sep 17 00:00:00 2001 |
| From: Peter Kalauskas <peskal@google.com> |
| Date: Tue, 21 Aug 2018 21:54:02 -0700 |
| Subject: drivers/block/zram/zram_drv.c: fix bug storing backing_dev |
| |
| From: Peter Kalauskas <peskal@google.com> |
| |
| commit c8bd134a4bddafe5917d163eea73873932c15e83 upstream. |
| |
| The call to strlcpy in backing_dev_store is incorrect. It should take |
| the size of the destination buffer instead of the size of the source |
| buffer. Additionally, ignore the newline character (\n) when reading |
| the new file_name buffer. This makes it possible to set the backing_dev |
| as follows: |
| |
| echo /dev/sdX > /sys/block/zram0/backing_dev |
| |
| The reason it worked before was the fact that strlcpy() copies 'len - 1' |
| bytes, which is strlen(buf) - 1 in our case, so it accidentally didn't |
| copy the trailing new line symbol. Which also means that "echo -n |
| /dev/sdX" most likely was broken. |
| |
| Signed-off-by: Peter Kalauskas <peskal@google.com> |
| Link: http://lkml.kernel.org/r/20180813061623.GC64836@rodete-desktop-imager.corp.google.com |
| Acked-by: Minchan Kim <minchan@kernel.org> |
| Reviewed-by: Sergey Senozhatsky <sergey.senozhatsky@gmail.com> |
| Cc: <stable@vger.kernel.org> [4.14+] |
| Signed-off-by: Andrew Morton <akpm@linux-foundation.org> |
| Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| drivers/block/zram/zram_drv.c | 7 ++++++- |
| 1 file changed, 6 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/block/zram/zram_drv.c |
| +++ b/drivers/block/zram/zram_drv.c |
| @@ -321,6 +321,7 @@ static ssize_t backing_dev_store(struct |
| struct device_attribute *attr, const char *buf, size_t len) |
| { |
| char *file_name; |
| + size_t sz; |
| struct file *backing_dev = NULL; |
| struct inode *inode; |
| struct address_space *mapping; |
| @@ -341,7 +342,11 @@ static ssize_t backing_dev_store(struct |
| goto out; |
| } |
| |
| - strlcpy(file_name, buf, len); |
| + strlcpy(file_name, buf, PATH_MAX); |
| + /* ignore trailing newline */ |
| + sz = strlen(file_name); |
| + if (sz > 0 && file_name[sz - 1] == '\n') |
| + file_name[sz - 1] = 0x00; |
| |
| backing_dev = filp_open(file_name, O_RDWR|O_LARGEFILE, 0); |
| if (IS_ERR(backing_dev)) { |