[PATCH] EDAC/xilinx: Fix stack off-by-one in debugfs UE injection handlers

[Zhuo, Qiuxu]

> From: Shengzhuo Wei <me at cherr.cc>
> Sent: Saturday, April 25, 2026 2:49 AM
> To: Shubhrajyoti Datta <shubhrajyoti.datta at amd.com>; Sai Krishna Potthuri
> <sai.krishna.potthuri at amd.com>; Borislav Petkov <bp at alien8.de>; Luck,
> Tony <tony.luck at intel.com>; Michal Simek <michal.simek at amd.com>
> Cc: linux-edac at vger.kernel.org; linux-kernel at vger.kernel.org; linux-arm-
> kernel at lists.infradead.org; Shengzhuo Wei <me at cherr.cc>
> Subject: [PATCH] EDAC/xilinx: Fix stack off-by-one in debugfs UE injection
> handlers
> 
> Two EDAC debugfs write handlers copy up to sizeof(buf) bytes into a fixed-size
> stack buffer and then unconditionally NUL-terminate it via buf[len] = '\0'.
> When userspace writes >= sizeof(buf) bytes, len becomes sizeof(buf) and the
> NUL write lands 1 byte past the end of the stack buffer.
> 
> Fix by clamping the copy length to sizeof(buf) - 1 so that the NUL terminator is
> always in-bounds.
> 
> Fixes: 3bd2706c910f ("EDAC/zynqmp: Add EDAC support for Xilinx ZynqMP
> OCM")
> Fixes: 83bf24051a60 ("EDAC/versal: Make the bit position of injected errors
> configurable")
> Signed-off-by: Shengzhuo Wei <me at cherr.cc>

LGTM,

  Reviewed-by: Qiuxu Zhuo <qiuxu.zhuo at intel.com>