[PATCH 1/2] EDAC/versal: reserve space for injection input terminator

[Jiale Yao]

inject_data_ue_store() caps the copy length at the full buffer size and
then writes a terminating NUL at buf[len]. An input of six bytes or more
therefore writes one byte beyond the stack buffer.

Limit the copied input to one byte less than the buffer size.

Fixes: 83bf24051a60 ("EDAC/versal: Make the bit position of injected errors configurable")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 drivers/edac/versal_edac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/edac/versal_edac.c b/drivers/edac/versal_edac.c
index 5a43b5d43ca2..917d7d1762aa 100644
--- a/drivers/edac/versal_edac.c
+++ b/drivers/edac/versal_edac.c
@@ -856,7 +856,7 @@ static ssize_t inject_data_ue_store(struct file *file, const char __user *data,
 	u8 len, ue0, ue1;
 	int i, ret;
 
-	len = min_t(size_t, count, sizeof(buf));
+	len = min_t(size_t, count, sizeof(buf) - 1);
 	if (copy_from_user(buf, data, len))
 		return -EFAULT;
 
-- 
2.34.1