Re: [patch] watchdog: pcwd_usb: overflow in usb_pcwd_send_command()

[Dan Carpenter <dan.carpenter@oracle.com>]

On Thu, Nov 07, 2013 at 06:27:29AM -0800, Guenter Roeck wrote:
> On 11/06/2013 11:40 PM, Dan Carpenter wrote:
> >We changed "buf" from being an array of 6 chars to being a pointer this
> >sizeof(buf) needs to be updated as well.
> >
> oops ...
> 
> >Fixes: 2ddb8089a7e5 ('watchdog: pcwd_usb: Use allocated buffer for usb_control_msg')
> >Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
> >
> >diff --git a/drivers/watchdog/pcwd_usb.c b/drivers/watchdog/pcwd_usb.c
> >index 53598e8..7031b9b 100644
> >--- a/drivers/watchdog/pcwd_usb.c
> >+++ b/drivers/watchdog/pcwd_usb.c
> >@@ -258,7 +258,7 @@ static int usb_pcwd_send_command(struct usb_pcwd_private *usb_pcwd,
> >
> >  	if (usb_control_msg(usb_pcwd->udev, usb_sndctrlpipe(usb_pcwd->udev, 0),
> >  			HID_REQ_SET_REPORT, HID_DT_REPORT,
> >-			0x0200, usb_pcwd->interface_number, buf, sizeof(buf),
> >+			0x0200, usb_pcwd->interface_number, buf, 6,
> >  			USB_COMMAND_TIMEOUT) != sizeof(buf)) {
> 
> Doesn't it have to be fixed here as well ?

Yeah.  Good eye.  I'll send a v2.

regards,
dan carpenter