From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date: Thu, 6 Dec 2018 12:48:55 +0000 (+0100)
Subject: 4.14-stable patches
X-Git-Tag: v4.19.8~9
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=c109a33aa720a172d9032052fb70373c5cb59bf0;p=thirdparty%2Fkernel%2Fstable-queue.git

4.14-stable patches

added patches:
	net-qed-use-correct-strncpy-size.patch
	tipc-use-destination-length-for-copy-string.patch
---

diff --git a/queue-4.14/net-qed-use-correct-strncpy-size.patch b/queue-4.14/net-qed-use-correct-strncpy-size.patch
new file mode 100644
index 00000000000..d2a503bcb04
--- /dev/null
+++ b/queue-4.14/net-qed-use-correct-strncpy-size.patch
@@ -0,0 +1,41 @@
+From 11f711081af0eb54190dc0de96ba4a9cd494666b Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Fri, 2 Feb 2018 16:44:47 +0100
+Subject: net: qed: use correct strncpy() size
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 11f711081af0eb54190dc0de96ba4a9cd494666b upstream.
+
+passing the strlen() of the source string as the destination
+length is pointless, and gcc-8 now warns about it:
+
+drivers/net/ethernet/qlogic/qed/qed_debug.c: In function 'qed_grc_dump':
+include/linux/string.h:253: error: 'strncpy' specified bound depends on the length of the source argument [-Werror=stringop-overflow=]
+
+This changes qed_grc_dump_big_ram() to instead uses the length of
+the destination buffer, and use strscpy() to guarantee nul-termination.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/ethernet/qlogic/qed/qed_debug.c |    6 ++----
+ 1 file changed, 2 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
+@@ -3590,10 +3590,8 @@ static u32 qed_grc_dump_big_ram(struct q
+ 	total_blocks = big_ram->num_of_blocks[dev_data->chip_id];
+ 	ram_size = total_blocks * BIG_RAM_BLOCK_SIZE_DWORDS;
+ 
+-	strncpy(type_name, big_ram->instance_name,
+-		strlen(big_ram->instance_name));
+-	strncpy(mem_name, big_ram->instance_name,
+-		strlen(big_ram->instance_name));
++	strscpy(type_name, big_ram->instance_name, sizeof(type_name));
++	strscpy(mem_name, big_ram->instance_name, sizeof(mem_name));
+ 
+ 	/* Dump memory header */
+ 	offset += qed_grc_dump_mem_hdr(p_hwfn,
diff --git a/queue-4.14/series b/queue-4.14/series
index ab0b914b7c8..8482f8584ed 100644
--- a/queue-4.14/series
+++ b/queue-4.14/series
@@ -51,3 +51,5 @@ thermal-drivers-hisi-encapsulate-register-writes-into-helpers.patch
 thermal-drivers-hisi-fix-configuration-register-setting.patch
 thermal-drivers-hisi-remove-costly-sensor-inspection.patch
 mm-hide-incomplete-nr_indirectly_reclaimable-in-proc-zoneinfo.patch
+net-qed-use-correct-strncpy-size.patch
+tipc-use-destination-length-for-copy-string.patch
diff --git a/queue-4.14/tipc-use-destination-length-for-copy-string.patch b/queue-4.14/tipc-use-destination-length-for-copy-string.patch
new file mode 100644
index 00000000000..002006a580c
--- /dev/null
+++ b/queue-4.14/tipc-use-destination-length-for-copy-string.patch
@@ -0,0 +1,43 @@
+From 29e270fc32192e7729057963ae7120663856c93e Mon Sep 17 00:00:00 2001
+From: Guoqing Jiang <gqjiang@suse.com>
+Date: Fri, 19 Oct 2018 12:08:22 +0800
+Subject: tipc: use destination length for copy string
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Guoqing Jiang <gqjiang@suse.com>
+
+commit 29e270fc32192e7729057963ae7120663856c93e upstream.
+
+Got below warning with gcc 8.2 compiler.
+
+net/tipc/topsrv.c: In function ‘tipc_topsrv_start’:
+net/tipc/topsrv.c:660:2: warning: ‘strncpy’ specified bound depends on the length of the source argument [-Wstringop-overflow=]
+  strncpy(srv->name, name, strlen(name) + 1);
+  ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+net/tipc/topsrv.c:660:27: note: length computed here
+  strncpy(srv->name, name, strlen(name) + 1);
+                           ^~~~~~~~~~~~
+So change it to correct length and use strscpy.
+
+Signed-off-by: Guoqing Jiang <gqjiang@suse.com>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/tipc/subscr.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/tipc/subscr.c
++++ b/net/tipc/subscr.c
+@@ -375,7 +375,7 @@ int tipc_topsrv_start(struct net *net)
+ 	topsrv->tipc_conn_new		= tipc_subscrb_connect_cb;
+ 	topsrv->tipc_conn_release	= tipc_subscrb_release_cb;
+ 
+-	strncpy(topsrv->name, name, strlen(name) + 1);
++	strscpy(topsrv->name, name, sizeof(topsrv->name));
+ 	tn->topsrv = topsrv;
+ 	atomic_set(&tn->subscription_count, 0);
+