[PATCH] media: mediatek: vcodec: NUL-terminate debugfs input

[Jiale Yao]

mtk_vdec_dbgfs_write() allows userspace to overwrite every byte in the
persistent debugfs buffer. The read handler later searches that buffer with
strstr(), which can read past its end when no NUL remains.

Reserve one byte and terminate the copied input at the updated file
position before releasing the debugfs lock.

Fixes: 5e488a4fd859 ("media: mediatek: vcodec: Add a debugfs file to get different useful information")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Jiale Yao <yaojiale02@xxxxxxx>
---
 .../media/platform/mediatek/vcodec/common/mtk_vcodec_dbgfs.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_dbgfs.c b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_dbgfs.c
index 2da11521fc7b..8528534e41ef 100644
--- a/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_dbgfs.c
+++ b/drivers/media/platform/mediatek/vcodec/common/mtk_vcodec_dbgfs.c
@@ -77,8 +77,11 @@ static ssize_t mtk_vdec_dbgfs_write(struct file *filp, const char __user *ubuf,
 	struct mtk_vcodec_dbgfs *dbgfs = &vcodec_dev->dbgfs;
 
 	mutex_lock(&dbgfs->dbgfs_lock);
-	dbgfs->buf_size = simple_write_to_buffer(dbgfs->dbgfs_buf, sizeof(dbgfs->dbgfs_buf),
+	dbgfs->buf_size = simple_write_to_buffer(dbgfs->dbgfs_buf,
+						 sizeof(dbgfs->dbgfs_buf) - 1,
 						 ppos, ubuf, count);
+	if (dbgfs->buf_size > 0)
+		dbgfs->dbgfs_buf[*ppos] = '\0';
 	mutex_unlock(&dbgfs->dbgfs_lock);
 	if (dbgfs->buf_size > 0)
 		return count;
-- 
2.34.1