]> git.baikalelectronics.ru Git - kernel.git/commit
ACPI: battery: Fix missing NUL-termination with large strings
authorArmin Wolf <W_Armin@gmx.de>
Sat, 14 Jan 2023 08:50:50 +0000 (09:50 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 10 Mar 2023 08:32:56 +0000 (09:32 +0100)
commit4e19b8a115a61d8a58e488309a0a5bdcc4847ac1
treeea16ca27a076dd51117a68ca2a647ceff08e8772
parent595f7da8824a507992b0d652f9c1eb68c8977417
ACPI: battery: Fix missing NUL-termination with large strings

[ Upstream commit 397da6bd7610ac65f7113ec3d59d84fe21cd568a ]

When encountering a string bigger than the destination buffer (32 bytes),
the string is not properly NUL-terminated, causing buffer overreads later.

This for example happens on the Inspiron 3505, where the battery
model name is larger than 32 bytes, which leads to sysfs showing
the model name together with the serial number string (which is
NUL-terminated and thus prevents worse).

Fix this by using strscpy() which ensures that the result is
always NUL-terminated.

Fixes: 60b9578c2c8b ("ACPI: Battery: Allow extract string from integer")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/acpi/battery.c