]>
Commit | Line | Data |
---|---|---|
46eff07a GKH |
1 | From foo@baz Sat Sep 29 04:30:43 PDT 2018 |
2 | From: Vasily Gorbik <gor@linux.ibm.com> | |
3 | Date: Sun, 17 Jun 2018 00:30:43 +0200 | |
4 | Subject: s390/extmem: fix gcc 8 stringop-overflow warning | |
5 | ||
6 | From: Vasily Gorbik <gor@linux.ibm.com> | |
7 | ||
8 | [ Upstream commit 6b2ddf33baec23dace85bd647e3fc4ac070963e8 ] | |
9 | ||
10 | arch/s390/mm/extmem.c: In function '__segment_load': | |
11 | arch/s390/mm/extmem.c:436:2: warning: 'strncat' specified bound 7 equals | |
12 | source length [-Wstringop-overflow=] | |
13 | strncat(seg->res_name, " (DCSS)", 7); | |
14 | ||
15 | What gcc complains about here is the misuse of strncat function, which | |
16 | in this case does not limit a number of bytes taken from "src", so it is | |
17 | in the end the same as strcat(seg->res_name, " (DCSS)"); | |
18 | ||
19 | Keeping in mind that a res_name is 15 bytes, strncat in this case | |
20 | would overflow the buffer and write 0 into alignment byte between the | |
21 | fields in the struct. To avoid that increasing res_name size to 16, | |
22 | and reusing strlcat. | |
23 | ||
24 | Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com> | |
25 | Signed-off-by: Vasily Gorbik <gor@linux.ibm.com> | |
26 | Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com> | |
27 | Signed-off-by: Sasha Levin <alexander.levin@microsoft.com> | |
28 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
29 | --- | |
30 | arch/s390/mm/extmem.c | 4 ++-- | |
31 | 1 file changed, 2 insertions(+), 2 deletions(-) | |
32 | ||
33 | --- a/arch/s390/mm/extmem.c | |
34 | +++ b/arch/s390/mm/extmem.c | |
35 | @@ -79,7 +79,7 @@ struct qin64 { | |
36 | struct dcss_segment { | |
37 | struct list_head list; | |
38 | char dcss_name[8]; | |
39 | - char res_name[15]; | |
40 | + char res_name[16]; | |
41 | unsigned long start_addr; | |
42 | unsigned long end; | |
43 | atomic_t ref_count; | |
44 | @@ -434,7 +434,7 @@ __segment_load (char *name, int do_nonsh | |
45 | memcpy(&seg->res_name, seg->dcss_name, 8); | |
46 | EBCASC(seg->res_name, 8); | |
47 | seg->res_name[8] = '\0'; | |
48 | - strncat(seg->res_name, " (DCSS)", 7); | |
49 | + strlcat(seg->res_name, " (DCSS)", sizeof(seg->res_name)); | |
50 | seg->res->name = seg->res_name; | |
51 | rc = seg->vm_segtype; | |
52 | if (rc == SEG_TYPE_SC || |