From 16a7a0f6307829e99f506568165a377f516df853 Mon Sep 17 00:00:00 2001 From: Michal Kalderon Date: Sun, 8 Jul 2018 20:08:35 +0300 Subject: [PATCH] BACKPORT qed: Fix copying 2 strings The strscpy() was a recent fix (net: qed: use correct strncpy() size) to prevent passing the length of the source buffer to strncpy() and guarantee null termination. It misses the goal of overwriting only the first 3 characters in "???_BIG_RAM" and "???_RAM" while keeping the rest of the string. Use strncpy() with the length of 3, without null termination. Signed-off-by: Denis Bolotin Signed-off-by: Michal Kalderon --- ...5-BACKPORT-qed-Fix-copying-2-strings.patch | 45 +++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 patches/0005-BACKPORT-qed-Fix-copying-2-strings.patch diff --git a/patches/0005-BACKPORT-qed-Fix-copying-2-strings.patch b/patches/0005-BACKPORT-qed-Fix-copying-2-strings.patch new file mode 100644 index 0000000..ff5ec98 --- /dev/null +++ b/patches/0005-BACKPORT-qed-Fix-copying-2-strings.patch @@ -0,0 +1,45 @@ +From c7d852e301d834949e570920db808201bdc51a22 Mon Sep 17 00:00:00 2001 +From: Denis Bolotin +Date: Tue, 24 Apr 2018 15:32:53 +0300 +Subject: [PATCH] qed: Fix copying 2 strings + +The strscpy() was a recent fix (net: qed: use correct strncpy() size) to +prevent passing the length of the source buffer to strncpy() and guarantee +null termination. +It misses the goal of overwriting only the first 3 characters in +"???_BIG_RAM" and "???_RAM" while keeping the rest of the string. +Use strncpy() with the length of 3, without null termination. + +Signed-off-by: Denis Bolotin +Signed-off-by: Ariel Elior +Signed-off-by: David S. Miller +--- + drivers/net/ethernet/qlogic/qed/qed_debug.c | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c +index b3211c7..39124b5 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c +@@ -419,6 +419,7 @@ struct phy_defs { + #define NUM_RSS_MEM_TYPES 5 + + #define NUM_BIG_RAM_TYPES 3 ++#define BIG_RAM_NAME_LEN 3 + + #define NUM_PHY_TBUS_ADDRESSES 2048 + #define PHY_DUMP_SIZE_DWORDS (NUM_PHY_TBUS_ADDRESSES / 2) +@@ -3650,8 +3651,8 @@ static u32 qed_grc_dump_big_ram(struct qed_hwfn *p_hwfn, + BIT(big_ram->is_256b_bit_offset[dev_data->chip_id]) ? 256 + : 128; + +- strscpy(type_name, big_ram->instance_name, sizeof(type_name)); +- strscpy(mem_name, big_ram->instance_name, sizeof(mem_name)); ++ strncpy(type_name, big_ram->instance_name, BIG_RAM_NAME_LEN); ++ strncpy(mem_name, big_ram->instance_name, BIG_RAM_NAME_LEN); + + /* Dump memory header */ + offset += qed_grc_dump_mem_hdr(p_hwfn, +-- +2.9.5 + -- 2.46.0