scsi: lpfc: Fix sprintf() overflow in lpfc_display_fpin_wwpn()

This scnprintf() uses the wrong limit.  It should be
"LPFC_FPIN_WWPN_LINE_SZ - len" instead of LPFC_FPIN_WWPN_LINE_SZ.

Link: https://lore.kernel.org/r/20210916132251.GD25094@kili
Fixes: 428569e66fa7 ("scsi: lpfc: Expand FPIN and RDF receive logging")
Reviewed-by: James Smart <jsmart2021@gmail.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c
index f3fc79b9916513713411e5895960a58ec045867c..052c0e5b11195f3f94559d8a027ff5a6128b1312 100644 (file)
--- a/drivers/scsi/lpfc/lpfc_els.c
+++ b/drivers/scsi/lpfc/lpfc_els.c
@@ -9387,7 +9387,7 @@ lpfc_display_fpin_wwpn(struct lpfc_hba *phba, __be64 *wwnlist, u32 cnt)
                /* Extract the next WWPN from the payload */
                wwn = *wwnlist++;
                wwpn = be64_to_cpu(wwn);
-               len += scnprintf(buf + len, LPFC_FPIN_WWPN_LINE_SZ,
+               len += scnprintf(buf + len, LPFC_FPIN_WWPN_LINE_SZ - len,
                                 " %016llx", wwpn);
 
                /* Log a message if we are on the last WWPN