From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E74D2BA49 for ; Tue, 7 Mar 2023 18:49:28 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 4D353C4339C; Tue, 7 Mar 2023 18:49:28 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1678214968; bh=F9M0gLX4GZu/ma638TAueHQhfctg4zX+ac5sJwXmwp8=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=yRhkrOaQYKTWU9NlpcwYqsS98Y/NWRXukOfZfweCeLe/d6ALrBh94BdNd6HQZOp7R hSrDZrHOvkayCVWAzblr8njytRRlmBOizwFdbLSVJ8e/Z+l+b/Yclidl5NSi6aaI3F uLW9UfRiFqjPNyopN+hlxi8x6LBnWqoLYNTHt1+E= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Armin Wolf , "Rafael J. Wysocki" , Sasha Levin Subject: [PATCH 5.15 108/567] ACPI: battery: Fix missing NUL-termination with large strings Date: Tue, 7 Mar 2023 17:57:24 +0100 Message-Id: <20230307165910.578097836@linuxfoundation.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230307165905.838066027@linuxfoundation.org> References: <20230307165905.838066027@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Armin Wolf [ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ] When encountering a string bigger than the destination buffer (32 bytes), the string is not properly NUL-terminated, causing buffer overreads later. This for example happens on the Inspiron 3505, where the battery model name is larger than 32 bytes, which leads to sysfs showing the model name together with the serial number string (which is NUL-terminated and thus prevents worse). Fix this by using strscpy() which ensures that the result is always NUL-terminated. Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer") Signed-off-by: Armin Wolf Signed-off-by: Rafael J. Wysocki Signed-off-by: Sasha Levin --- drivers/acpi/battery.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c index 56db7b4da5140..c7569151fd02a 100644 --- a/drivers/acpi/battery.c +++ b/drivers/acpi/battery.c @@ -449,7 +449,7 @@ static int extract_package(struct acpi_battery *battery, if (element->type == ACPI_TYPE_STRING || element->type == ACPI_TYPE_BUFFER) - strncpy(ptr, element->string.pointer, 32); + strscpy(ptr, element->string.pointer, 32); else if (element->type == ACPI_TYPE_INTEGER) { strncpy(ptr, (u8 *)&element->integer.value, sizeof(u64)); -- 2.39.2