提交 6b6680c4 编写于 作者: C Chen Gang 提交者: Benjamin Herrenschmidt

powerpc/pseries/hvcserver: Fix strncpy buffer limit in location code

the dest buf len is 80 (HVCS_CLC_LENGTH + 1).
  the src buf len is PAGE_SIZE.
  if src buf string len is more than 80, it will cause issue.
Signed-off-by: NChen Gang <gang.chen@asianux.com>
Signed-off-by: NBenjamin Herrenschmidt <benh@kernel.crashing.org>
上级 27777890
...@@ -23,6 +23,7 @@ ...@@ -23,6 +23,7 @@
#include <linux/list.h> #include <linux/list.h>
#include <linux/module.h> #include <linux/module.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/string.h>
#include <asm/hvcall.h> #include <asm/hvcall.h>
#include <asm/hvcserver.h> #include <asm/hvcserver.h>
...@@ -188,9 +189,9 @@ int hvcs_get_partner_info(uint32_t unit_address, struct list_head *head, ...@@ -188,9 +189,9 @@ int hvcs_get_partner_info(uint32_t unit_address, struct list_head *head,
= (unsigned int)last_p_partition_ID; = (unsigned int)last_p_partition_ID;
/* copy the Null-term char too */ /* copy the Null-term char too */
strncpy(&next_partner_info->location_code[0], strlcpy(&next_partner_info->location_code[0],
(char *)&pi_buff[2], (char *)&pi_buff[2],
strlen((char *)&pi_buff[2]) + 1); sizeof(next_partner_info->location_code));
list_add_tail(&(next_partner_info->node), head); list_add_tail(&(next_partner_info->node), head);
next_partner_info = NULL; next_partner_info = NULL;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册