ACPI: battery: Fix missing NUL-termination with large strings
stable inclusion from stable-v5.10.173 commit 6fb7dead798c97f6c13acdea1023979d16dd7482 category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/I8BFR3 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=6fb7dead798c97f6c13acdea1023979d16dd7482 -------------------------------- [ Upstream commit f2ac14b5 ] When encountering a string bigger than the destination buffer (32 bytes), the string is not properly NUL-terminated, causing buffer overreads later. This for example happens on the Inspiron 3505, where the battery model name is larger than 32 bytes, which leads to sysfs showing the model name together with the serial number string (which is NUL-terminated and thus prevents worse). Fix this by using strscpy() which ensures that the result is always NUL-terminated. Fixes: 106449e8 ("ACPI: Battery: Allow extract string from integer") Signed-off-by:Armin Wolf <W_Armin@gmx.de> Signed-off-by:
Rafael J. Wysocki <rafael.j.wysocki@intel.com> Signed-off-by:
Sasha Levin <sashal@kernel.org> Signed-off-by:
sanglipeng <sanglipeng1@jd.com>
Loading
Please sign in to comment