Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux

powerpc/pseries/hvcserver: Fix strncpy buffer limit in location code

the dest buf len is 80 (HVCS_CLC_LENGTH + 1).
the src buf len is PAGE_SIZE.
if src buf string len is more than 80, it will cause issue.

Signed-off-by: Chen Gang <gang.chen@asianux.com>
Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>

authored by

Chen Gang and committed by
Benjamin Herrenschmidt
6b6680c4 27777890

+3 -2
+3 -2
arch/powerpc/platforms/pseries/hvcserver.c
··· 23 23 #include <linux/list.h> 24 24 #include <linux/module.h> 25 25 #include <linux/slab.h> 26 + #include <linux/string.h> 26 27 27 28 #include <asm/hvcall.h> 28 29 #include <asm/hvcserver.h> ··· 189 188 = (unsigned int)last_p_partition_ID; 190 189 191 190 /* copy the Null-term char too */ 192 - strncpy(&next_partner_info->location_code[0], 191 + strlcpy(&next_partner_info->location_code[0], 193 192 (char *)&pi_buff[2], 194 - strlen((char *)&pi_buff[2]) + 1); 193 + sizeof(next_partner_info->location_code)); 195 194 196 195 list_add_tail(&(next_partner_info->node), head); 197 196 next_partner_info = NULL;