]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
ACPI: battery: Fix missing NUL-termination with large strings
authorArmin Wolf <W_Armin@gmx.de>
Sat, 14 Jan 2023 08:50:50 +0000 (09:50 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Sat, 11 Mar 2023 15:26:36 +0000 (16:26 +0100)
commit8a9a8547e8af1cf28d39b04f2d1cc021e5c9dfaa
tree00f95402d59aaa2e189a292f2e56557e36d94eaf
parent89a33c3c847b19b19205cde1d924df2a6c70d8eb
ACPI: battery: Fix missing NUL-termination with large strings

[ Upstream commit f2ac14b5f197e4a2dec51e5ceaa56682ff1592bc ]

When encountering a string bigger than the destination buffer (32 bytes),
the string is not properly NUL-terminated, causing buffer overreads later.

This for example happens on the Inspiron 3505, where the battery
model name is larger than 32 bytes, which leads to sysfs showing
the model name together with the serial number string (which is
NUL-terminated and thus prevents worse).

Fix this by using strscpy() which ensures that the result is
always NUL-terminated.

Fixes: 106449e870b3 ("ACPI: Battery: Allow extract string from integer")
Signed-off-by: Armin Wolf <W_Armin@gmx.de>
Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/acpi/battery.c