From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 4AF2C35AC03; Fri, 4 Sep 2026 05:55:39 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788501340; cv=none; b=NCC4BYsweHJxdOIUTKX1iVjs3ulkc03il+WB5fyM/89cCWRjGRK2WhWKnYaJiPygoe9+4B3l6mn6HcDqmlJKgTtyzOnwjniE6FChATtTQsEmX5zqKqmk+oqwR08lesACDhSm9/50hG4+oD3nVAfAyKSlck+pUd5Cmlv/U6GPynE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1788501340; c=relaxed/simple; bh=/EYH0W4OXCf0WN5TGwwzp2POBaD1tZRihYxCmt1f7Ho=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=bfbvI+5HVj82VAGpG8vpe1FR4jVD0KVWuNIa514J5o6L5CFD5RaVTBXwJhOOeBuYuXizSABTMXjvEvCSrAu9oWx5ZyaiOiPNlKUThOh782QP6v1IEEfeKNM60zq42ngebbP4QssdUtPWnewRCJPuQtU74Ovoef392AgtAi11r+E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=LtID53uj; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="LtID53uj" Received: by smtp.kernel.org (Postfix) with ESMTPSA id A74501F00A3D; Fri, 4 Sep 2026 05:55:38 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1788501339; bh=GJ+AFxhYLiVt3DSPvC9Pq4yPKdxDh9IR0yp3whgXnHI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=LtID53ujoakMJQh5lj9nj6MSmpdTZjHQvF/NTePQXOuaEtRDLqYPfq6raAVhpHckN 75LKKO4X0rLi5VrdZKx6cHtZrGskifyHOMKgLXPLQ+MorLhUEM2DBGDmgh0oG3ScUh JvlOn5H97DE3M5jkk1yPfHYx2U1pMzl7jUkTF/fA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, HyeongJun An , Sebastian Reichel Subject: [PATCH 6.18 375/552] power: supply: qcom_battmgr: terminate the strings from firmware Date: Fri, 4 Sep 2026 06:58:52 +0200 Message-ID: <20260904045758.724098003@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260904045747.813364717@linuxfoundation.org> References: <20260904045747.813364717@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.18-stable review patch. If anyone has any objections, please let me know. ------------------ From: HyeongJun An commit ab1112df8f4ffa88cb024dd370c432ced80f77d8 upstream. The qcom_battmgr_sc8280xp_strcpy() takes a Pascal-style string when the firmware sends one. Otherwise it copies all BATTMGR_STRING_LEN bytes and leaves the destination without a terminator. Those destinations are model_number, serial_number and oem_info, each BATTMGR_STRING_LEN and declared next to each other. They go out to user space as val->strval, which power_supply_format_property() prints with "%s", so a firmware string that fills the whole field makes that read run into the following members. Use strscpy() so the copy always terminates, the way the SM8350 path already does for the same field. Fixes: 29e8142b5623 ("power: supply: Introduce Qualcomm PMIC GLINK power supply") Cc: stable@vger.kernel.org Assisted-by: Claude:claude-opus-4-8 Signed-off-by: HyeongJun An Link: https://patch.msgid.link/20260727074119.2585463-1-sammiee5311@gmail.com Signed-off-by: Sebastian Reichel Signed-off-by: Greg Kroah-Hartman --- drivers/power/supply/qcom_battmgr.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) --- a/drivers/power/supply/qcom_battmgr.c +++ b/drivers/power/supply/qcom_battmgr.c @@ -1236,7 +1236,7 @@ static void qcom_battmgr_sc8280xp_strcpy memcpy(dest, src + 1, len); dest[len] = '\0'; } else { - memcpy(dest, src, BATTMGR_STRING_LEN); + strscpy(dest, src, BATTMGR_STRING_LEN); } }