scsi: scsi_debug: Fix some bugs in sdebug_error_write()

There are two bug in this code:

 1) If count is zero, then it will lead to a NULL dereference.  The
    kmalloc() will successfully allocate zero bytes and the test for "if
    (buf[0] == '-')" will read beyond the end of the zero size buffer and
    Oops.

 2) The code does not ensure that the user's string is properly NUL
    terminated which could lead to a read overflow.

Fixes: a9996d722b11 ("scsi: scsi_debug: Add interface to manage error injection for a single device")
Signed-off-by: Dan Carpenter <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Reviewed-by: Wenchao Hao <[email protected]>
Signed-off-by: Martin K. Petersen <[email protected]>

0 files changed, 0 insertions, 0 deletions