[PATCH] sysfs: zero terminate sysfs write buffers (CVE-2006-1055)

No one should be writing a PAGE_SIZE worth of data to a normal sysfs
file, so properly terminate the buffer.

Thanks to Al Viro for pointing out my stupidity here.

CVE-2006-1055 has been assigned for this.

Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>

diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index d0e3d8495165205079ad8acef894744b517cfa18..2ecc58cc368a1a134b06e7fdad02f87daa43c97d 100644 (file)
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c
@@ -183,7 +183,7 @@ fill_write_buffer(struct sysfs_buffer * buffer, const char __user * buf, size_t
                return -ENOMEM;
 
        if (count >= PAGE_SIZE)
-               count = PAGE_SIZE;
+               count = PAGE_SIZE - 1;
        error = copy_from_user(buffer->page,buf,count);
        buffer->needs_read_fill = 1;
        return error ? -EFAULT : count;