| .. | .. |
|---|
| 311 | 311 | size_t length, loff_t *ppos) |
|---|
| 312 | 312 | { |
|---|
| 313 | 313 | int host, channel, id, lun; |
|---|
| 314 | | - char *buffer, *p; |
|---|
| 314 | + char *buffer, *end, *p; |
|---|
| 315 | 315 | int err; |
|---|
| 316 | 316 | |
|---|
| 317 | 317 | if (!buf || length > PAGE_SIZE) |
|---|
| .. | .. |
|---|
| 326 | 326 | goto out; |
|---|
| 327 | 327 | |
|---|
| 328 | 328 | err = -EINVAL; |
|---|
| 329 | | - if (length < PAGE_SIZE) |
|---|
| 330 | | - buffer[length] = '\0'; |
|---|
| 331 | | - else if (buffer[PAGE_SIZE-1]) |
|---|
| 332 | | - goto out; |
|---|
| 329 | + if (length < PAGE_SIZE) { |
|---|
| 330 | + end = buffer + length; |
|---|
| 331 | + *end = '\0'; |
|---|
| 332 | + } else { |
|---|
| 333 | + end = buffer + PAGE_SIZE - 1; |
|---|
| 334 | + if (*end) |
|---|
| 335 | + goto out; |
|---|
| 336 | + } |
|---|
| 333 | 337 | |
|---|
| 334 | 338 | /* |
|---|
| 335 | 339 | * Usage: echo "scsi add-single-device 0 1 2 3" >/proc/scsi/scsi |
|---|
| .. | .. |
|---|
| 338 | 342 | if (!strncmp("scsi add-single-device", buffer, 22)) { |
|---|
| 339 | 343 | p = buffer + 23; |
|---|
| 340 | 344 | |
|---|
| 341 | | - host = simple_strtoul(p, &p, 0); |
|---|
| 342 | | - channel = simple_strtoul(p + 1, &p, 0); |
|---|
| 343 | | - id = simple_strtoul(p + 1, &p, 0); |
|---|
| 344 | | - lun = simple_strtoul(p + 1, &p, 0); |
|---|
| 345 | + host = (p < end) ? simple_strtoul(p, &p, 0) : 0; |
|---|
| 346 | + channel = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0; |
|---|
| 347 | + id = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0; |
|---|
| 348 | + lun = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0; |
|---|
| 345 | 349 | |
|---|
| 346 | 350 | err = scsi_add_single_device(host, channel, id, lun); |
|---|
| 347 | 351 | |
|---|
| .. | .. |
|---|
| 352 | 356 | } else if (!strncmp("scsi remove-single-device", buffer, 25)) { |
|---|
| 353 | 357 | p = buffer + 26; |
|---|
| 354 | 358 | |
|---|
| 355 | | - host = simple_strtoul(p, &p, 0); |
|---|
| 356 | | - channel = simple_strtoul(p + 1, &p, 0); |
|---|
| 357 | | - id = simple_strtoul(p + 1, &p, 0); |
|---|
| 358 | | - lun = simple_strtoul(p + 1, &p, 0); |
|---|
| 359 | + host = (p < end) ? simple_strtoul(p, &p, 0) : 0; |
|---|
| 360 | + channel = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0; |
|---|
| 361 | + id = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0; |
|---|
| 362 | + lun = (p + 1 < end) ? simple_strtoul(p + 1, &p, 0) : 0; |
|---|
| 359 | 363 | |
|---|
| 360 | 364 | err = scsi_remove_single_device(host, channel, id, lun); |
|---|
| 361 | 365 | } |
|---|