Commit 6167a5b4 authored by Kamenee Arumugam's avatar Kamenee Arumugam Committed by Doug Ledford

IB/qib: Stricter bounds checking for copy to buffer

Replace 'strcpy' with 'strncpy' to restrict the number
of bytes copied to the buffer.
Reviewed-by: default avatarMichael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: default avatarKamenee Arumugam <kamenee.arumugam@intel.com>
Signed-off-by: default avatarDennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: default avatarDoug Ledford <dledford@redhat.com>
parent 34ab4de7
...@@ -6175,7 +6175,7 @@ static int setup_txselect(const char *str, struct kernel_param *kp) ...@@ -6175,7 +6175,7 @@ static int setup_txselect(const char *str, struct kernel_param *kp)
unsigned long val; unsigned long val;
char *n; char *n;
if (strlen(str) >= MAX_ATTEN_LEN) { if (strlen(str) >= ARRAY_SIZE(txselect_list)) {
pr_info("txselect_values string too long\n"); pr_info("txselect_values string too long\n");
return -ENOSPC; return -ENOSPC;
} }
...@@ -6186,7 +6186,7 @@ static int setup_txselect(const char *str, struct kernel_param *kp) ...@@ -6186,7 +6186,7 @@ static int setup_txselect(const char *str, struct kernel_param *kp)
TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ + TXDDS_MFG_SZ); TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ + TXDDS_MFG_SZ);
return -EINVAL; return -EINVAL;
} }
strcpy(txselect_list, str); strncpy(txselect_list, str, ARRAY_SIZE(txselect_list) - 1);
list_for_each_entry(dd, &qib_dev_list, list) list_for_each_entry(dd, &qib_dev_list, list)
if (dd->deviceid == PCI_DEVICE_ID_QLOGIC_IB_7322) if (dd->deviceid == PCI_DEVICE_ID_QLOGIC_IB_7322)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment