Merge tag 'for-linus-6.14-ofs4' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux

69b8923f · Linus Torvalds <[email protected]> · 2025-01-31 09:40:31 -08:00

Pull orangefs fix from Mike Marshall:
 "Fix a oob in orangefs_debug_write

  I got a syzbot report: "slab-out-of-bounds Read in orangefs_debug_write"

  Several people suggested fixes, I tested Al Viro's suggestion and made
  this patch"

* tag 'for-linus-6.14-ofs4' of git://git.kernel.org/pub/scm/linux/kernel/git/hubcap/linux:
  orangefs: fix a oob in orangefs_debug_write

Commit: 69b8923f5003664e3ffef102e73333edfa2abdcf
Parents: b2fde873 · f7c84843

Merge commit. Changes below are compared with the first parent: b2fde873.

Changes

1 files changed · +2 −2

File	Status	Add	Del	Content
fs/orangefs/orangefs-debugfs.c	modified	+2	−2	View file

fs/orangefs/orangefs-debugfs.c

View file

diff --git a/fs/orangefs/orangefs-debugfs.c b/fs/orangefs/orangefs-debugfs.c
index 9729f07..f520730 100644
--- a/fs/orangefs/orangefs-debugfs.c
+++ b/fs/orangefs/orangefs-debugfs.c
@@ -392,9 +392,9 @@ static ssize_t orangefs_debug_write(struct file *file,
 	 * Thwart users who try to jamb a ridiculous number
 	 * of bytes into the debug file...
 	 */
-	if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) {
+	if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) {
 		silly = count;
-		count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1;
+		count = ORANGEFS_MAX_DEBUG_STRING_LEN;
 	}
 
 	buf = kzalloc(ORANGEFS_MAX_DEBUG_STRING_LEN, GFP_KERNEL);