Re: [PATCH 1/2] iio: backend: make sure to NULL terminate stack buffer

[David Lechner <dlechner@baylibre.com>]

On 2/18/25 4:31 AM, Nuno Sá via B4 Relay wrote:
> From: Nuno Sá <nuno.sa@analog.com>
> 
> Make sure to NULL terminate the buffer in
> iio_backend_debugfs_write_reg() before passing it to sscanf(). It is a
> stack variable so we should not assume it will 0 initialized.
> 
> Fixes: cdf01e0809a4 ("iio: backend: add debugFs interface")
> Signed-off-by: Nuno Sá <nuno.sa@analog.com>
> ---
>  drivers/iio/industrialio-backend.c | 4 +++-
>  1 file changed, 3 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/iio/industrialio-backend.c b/drivers/iio/industrialio-backend.c
> index d4ad36f54090204bf3bef08457d4aa55aa7c11fc..a43c8d1bb3d0f4dda4277cac94b0ea9232c071e4 100644
> --- a/drivers/iio/industrialio-backend.c
> +++ b/drivers/iio/industrialio-backend.c
> @@ -155,10 +155,12 @@ static ssize_t iio_backend_debugfs_write_reg(struct file *file,
>  	ssize_t rc;
>  	int ret;
>  
> -	rc = simple_write_to_buffer(buf, sizeof(buf), ppos, userbuf, count);
> +	rc = simple_write_to_buffer(buf, sizeof(buf) - 1, ppos, userbuf, count);
>  	if (rc < 0)
>  		return rc;
>  
> +	buf[count] = '\0';

Does this need to be count++? Later we return count.

> +
>  	ret = sscanf(buf, "%i %i", &back->cached_reg_addr, &val);
>  
>  	switch (ret) {
>