usb: gadget: uvc: fix changing interface name via configfs

When setting the function name, it is always truncated by one char since
snprintf is always including the null-termination in the len parameter.
We use strscpy and fix the size setting to use len + 1 instead.

Fixes: 324e4f85070f ("usb: gadget: uvc: allow changing interface name via configfs")
Signed-off-by: Michael Grzeschik <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>

diff --git a/drivers/usb/gadget/function/uvc_configfs.c b/drivers/usb/gadget/function/uvc_configfs.c
index e5a6b6e36b3dd85cc72565cc2ad6e4076f719576..4303a3283ba0a3a3b9927391553546fe2fbb3ccf 100644 (file)
--- a/drivers/usb/gadget/function/uvc_configfs.c
+++ b/drivers/usb/gadget/function/uvc_configfs.c
@@ -2371,6 +2371,7 @@ static ssize_t f_uvc_opts_string_##cname##_store(struct config_item *item,\
                                          const char *page, size_t len) \
 {                                                                      \
        struct f_uvc_opts *opts = to_f_uvc_opts(item);                  \
+       int size = min(sizeof(opts->aname), len + 1);                   \
        int ret = 0;                                                    \
                                                                        \
        mutex_lock(&opts->lock);                                        \
@@ -2379,8 +2380,9 @@ static ssize_t f_uvc_opts_string_##cname##_store(struct config_item *item,\
                goto end;                                               \
        }                                                               \
                                                                        \
-       ret = snprintf(opts->aname, min(sizeof(opts->aname), len),      \
-                       "%s", page);                                    \
+       ret = strscpy(opts->aname, page, size);                         \
+       if (ret == -E2BIG)                                              \
+               ret = size - 1;                                         \
                                                                        \
 end:                                                                   \
        mutex_unlock(&opts->lock);                                      \