platform/x86: dell-wmi-sysman: bound enumeration string aggregation

populate_enum_data() aggregates firmware-provided value-modifier
and possible-value strings into fixed 512-byte struct members.
The current code bounds each individual source string but then
appends every string and separator with raw strcat() and no
remaining-space check.

Switch the aggregation loops to a bounded append helper and
reject enumeration packages whose combined strings do not fit
in the destination buffers.

Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260408084501.1-dell-wmi-sysman-v2-pengpeng@iscas.ac.cn
[ij: add include]
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

diff --git a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c
index 09996fbdc7074073c7bb74f0708fd21fc21626fe..a85639d8a076f2052b19835b2ff07a3b0c163394 100644 (file)
--- a/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c
+++ b/drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c
@@ -6,10 +6,32 @@
  *  Copyright (c) 2020 Dell Inc.
  */
 
+#include <linux/bug.h>
+
 #include "dell-wmi-sysman.h"
 
 get_instance_id(enumeration);
 
+static int append_enum_string(char *dest, const char *src)
+{
+       size_t dest_len = strlen(dest);
+       ssize_t copied;
+
+       if (WARN_ON_ONCE(dest_len >= MAX_BUFF))
+               return -EINVAL;
+
+       copied = strscpy(dest + dest_len, src, MAX_BUFF - dest_len);
+       if (copied < 0)
+               return -EINVAL;
+
+       dest_len += copied;
+       copied = strscpy(dest + dest_len, ";", MAX_BUFF - dest_len);
+       if (copied < 0)
+               return -EINVAL;
+
+       return 0;
+}
+
 static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf)
 {
        int instance_id = get_enumeration_instance_id(kobj);
@@ -176,9 +198,9 @@ int populate_enum_data(union acpi_object *enumeration_obj, int instance_id,
                        return -EINVAL;
                if (check_property_type(enumeration, next_obj, ACPI_TYPE_STRING))
                        return -EINVAL;
-               strcat(wmi_priv.enumeration_data[instance_id].dell_value_modifier,
-                       enumeration_obj[next_obj++].string.pointer);
-               strcat(wmi_priv.enumeration_data[instance_id].dell_value_modifier, ";");
+               if (append_enum_string(wmi_priv.enumeration_data[instance_id].dell_value_modifier,
+                                      enumeration_obj[next_obj++].string.pointer))
+                       return -EINVAL;
        }
 
        if (next_obj >= enum_property_count)
@@ -193,9 +215,9 @@ int populate_enum_data(union acpi_object *enumeration_obj, int instance_id,
                        return -EINVAL;
                if (check_property_type(enumeration, next_obj, ACPI_TYPE_STRING))
                        return -EINVAL;
-               strcat(wmi_priv.enumeration_data[instance_id].possible_values,
-                       enumeration_obj[next_obj++].string.pointer);
-               strcat(wmi_priv.enumeration_data[instance_id].possible_values, ";");
+               if (append_enum_string(wmi_priv.enumeration_data[instance_id].possible_values,
+                                      enumeration_obj[next_obj++].string.pointer))
+                       return -EINVAL;
        }
 
        return sysfs_create_group(attr_name_kobj, &enumeration_attr_group);