From ceaeddd0387521fb2d2d74994f337b4da800654a Mon Sep 17 00:00:00 2001 From: David Disseldorp Date: Tue, 29 Sep 2026 18:13:57 +1000 Subject: [PATCH] lkl/cptofs: fix copy_file short write handling On short write, copy_file() currently attempts to write any remainder from a source buffer address *after* the full read length. I've not actually triggered this code-path, but it's a theoretical buffer overrun. Fix it by incrementing the buffer address by the amount written instead of the read amount. Link: https://github.com/lkl/linux/issues/646 Signed-off-by: David Disseldorp --- tools/lkl/cptofs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/tools/lkl/cptofs.c b/tools/lkl/cptofs.c index aa11939c8097bf..cf0a56596f9131 100644 --- a/tools/lkl/cptofs.c +++ b/tools/lkl/cptofs.c @@ -242,7 +242,7 @@ static int copy_file(const char *src, const char *dst, int mode, uid_t owner, gi } to_write -= wrote; - ptr += len; + ptr += wrote; } while (to_write > 0); }