From nobody Thu Dec 18 03:56:29 2025 Received: from out-177.mta0.migadu.com (out-177.mta0.migadu.com [91.218.175.177]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 331E11C3BF7 for ; Mon, 15 Dec 2025 12:22:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=91.218.175.177 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765801360; cv=none; b=S2aCi7MJm8eneWKq/yKJXLiSlJDJfZkiIdbi6IHX2kigqW3MOgcjGE/n6bYOLk6LZaO6AQL65IaFKwXN1qwIlCqfkjlTJwQ3iM2wd0XLu6o4YPiZwWhgReBG2uu4Gr3kqw240wC8/3sfw2CGREqP3DiOqqTzesYKGYZWBLZ7RRA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765801360; c=relaxed/simple; bh=96QLPrrc2OBC50JADV6ayGtUDJLMXKRTwoyE2D7yP6I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=lJJZ4Js23jUC071M/elH455Ggm0/S7MUGdGelLLi/dk1Taqe1ZW4pa4ockbBgBuINgEl4ztDolL0yr6waK0udhxf4BtQWCnxuK3Xh6x24PvqHrN37w/cf+OCMLyD6FiYy+2u0lyhSXPLC6Zdpd3mtdtLVr+Au3ONULpvXox/Jtk= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev; spf=pass smtp.mailfrom=linux.dev; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b=ox7RqcDJ; arc=none smtp.client-ip=91.218.175.177 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=linux.dev Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=linux.dev Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linux.dev header.i=@linux.dev header.b="ox7RqcDJ" X-Report-Abuse: Please report any abuse attempt to abuse@migadu.com and include these headers. DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linux.dev; s=key1; t=1765801351; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=6ld/ZmD/dR1Psr1Cq3hfkaiQuLXvNdSYI64jtTRWPdE=; b=ox7RqcDJfCIcIN8Y6nnJ60fsocwgT9g22sg68FHHhiMZWthLRI5LHTYqnwNnFH6KrJQzGG t1XroUe6YNU4V1cy7aRmk682c1hrI4fbYGbZYjBG7fS+bwHQzIngYmUsrUN2bjCmPP3Ge6 Cnw2tMXn5Xk8JyndLkvV23gQuky4j6Q= From: Thorsten Blum To: Alexander Gordeev , Gerald Schaefer , Heiko Carstens , Vasily Gorbik , Christian Borntraeger , Sven Schnelle Cc: Thorsten Blum , linux-s390@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] s390/cmm: Account for NUL when calculating 'len' in cmm_timeout_handler Date: Mon, 15 Dec 2025 13:22:14 +0100 Message-ID: <20251215122214.381098-2-thorsten.blum@linux.dev> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Migadu-Flow: FLOW_OUT Content-Type: text/plain; charset="utf-8" When the input length 'lenp' equals sizeof(buf), the current code copies all 64 bytes, but then immediately overwrites the last byte with a NUL terminator. Limit the number of bytes to copy to 'sizeof(buf) - 1' to reserve space for the NUL terminator. Signed-off-by: Thorsten Blum --- arch/s390/mm/cmm.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/arch/s390/mm/cmm.c b/arch/s390/mm/cmm.c index eb7ef63fab1e..06512bc178a5 100644 --- a/arch/s390/mm/cmm.c +++ b/arch/s390/mm/cmm.c @@ -311,9 +311,9 @@ static int cmm_timeout_handler(const struct ctl_table *= ctl, int write, } =20 if (write) { - len =3D min(*lenp, sizeof(buf)); + len =3D min(*lenp, sizeof(buf) - 1); memcpy(buf, buffer, len); - buf[len - 1] =3D '\0'; + buf[len] =3D '\0'; cmm_skip_blanks(buf, &p); nr =3D simple_strtoul(p, &p, 0); cmm_skip_blanks(p, &p); --=20 Thorsten Blum GPG: 1D60 735E 8AEF 3BE4 73B6 9D84 7336 78FD 8DFE EAD4