4.14-stable patches

added patches:
	net-qed-use-correct-strncpy-size.patch
	tipc-use-destination-length-for-copy-string.patch

diff --git a/queue-4.14/net-qed-use-correct-strncpy-size.patch b/queue-4.14/net-qed-use-correct-strncpy-size.patch
new file mode 100644 (file)
index 0000000..d2a503b
--- /dev/null
+++ b/queue-4.14/net-qed-use-correct-strncpy-size.patch
@@ -0,0 +1,41 @@
+From 11f711081af0eb54190dc0de96ba4a9cd494666b Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 2 Feb 2018 16:44:47 +0100
+Subject: net: qed: use correct strncpy() size
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 11f711081af0eb54190dc0de96ba4a9cd494666b upstream.
+
+passing the strlen() of the source string as the destination
+length is pointless, and gcc-8 now warns about it:
+
+drivers/net/ethernet/qlogic/qed/qed_debug.c: In function 'qed_grc_dump':
+include/linux/string.h:253: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
+
+This changes qed_grc_dump_big_ram() to instead uses the length of
+the destination buffer, and use strscpy() to guarantee nul-termination.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/qlogic/qed/qed_debug.c |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
+@@ -3590,10 +3590,8 @@ static u32 qed_grc_dump_big_ram(struct q
+       total_blocks = big_ram->num_of_blocks[dev_data->chip_id];
+       ram_size = total_blocks * BIG_RAM_BLOCK_SIZE_DWORDS;
+ 
+-      strncpy(type_name, big_ram->instance_name,
+-              strlen(big_ram->instance_name));
+-      strncpy(mem_name, big_ram->instance_name,
+-              strlen(big_ram->instance_name));
++      strscpy(type_name, big_ram->instance_name, sizeof(type_name));
++      strscpy(mem_name, big_ram->instance_name, sizeof(mem_name));
+ 
+       /* Dump memory header */
+       offset += qed_grc_dump_mem_hdr(p_hwfn,

diff --git a/queue-4.14/series b/queue-4.14/series
index ab0b914b7c80b02b890f103b2051f812ebeaf162..8482f8584edcc902ff755570e0cb903a3f9b40ab 100644 (file)
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -51,3 +51,5 @@ thermal-drivers-hisi-encapsulate-register-writes-into-helpers.patch
 thermal-drivers-hisi-fix-configuration-register-setting.patch
 thermal-drivers-hisi-remove-costly-sensor-inspection.patch
 mm-hide-incomplete-nr_indirectly_reclaimable-in-proc-zoneinfo.patch
+net-qed-use-correct-strncpy-size.patch
+tipc-use-destination-length-for-copy-string.patch

diff --git a/queue-4.14/tipc-use-destination-length-for-copy-string.patch b/queue-4.14/tipc-use-destination-length-for-copy-string.patch
new file mode 100644 (file)
index 0000000..002006a
--- /dev/null
+++ b/queue-4.14/tipc-use-destination-length-for-copy-string.patch
@@ -0,0 +1,43 @@
+From 29e270fc32192e7729057963ae7120663856c93e Mon Sep 17 00:00:00 2001
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Fri, 19 Oct 2018 12:08:22 +0800
+Subject: tipc: use destination length for copy string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guoqing Jiang <gqjiang@suse.com>
+
+commit 29e270fc32192e7729057963ae7120663856c93e upstream.
+
+Got below warning with gcc 8.2 compiler.
+
+net/tipc/topsrv.c: In function ‘tipc_topsrv_start’:
+net/tipc/topsrv.c:660:2: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=]
+  strncpy(srv->name, name, strlen(name) + 1);
+  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+net/tipc/topsrv.c:660:27: note: length computed here
+  strncpy(srv->name, name, strlen(name) + 1);
+                           ^~~~~~~~~~~~
+So change it to correct length and use strscpy.
+
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/tipc/subscr.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/tipc/subscr.c
++++ b/net/tipc/subscr.c
+@@ -375,7 +375,7 @@ int tipc_topsrv_start(struct net *net)
+       topsrv->tipc_conn_new           = tipc_subscrb_connect_cb;
+       topsrv->tipc_conn_release       = tipc_subscrb_release_cb;
+ 
+-      strncpy(topsrv->name, name, strlen(name) + 1);
++      strscpy(topsrv->name, name, sizeof(topsrv->name));
+       tn->topsrv = topsrv;
+       atomic_set(&tn->subscription_count, 0);
+