Tyrel Datwyler be1f58e58f PCI: rpadlpar: Fix potential drc_name corruption in store functions ... commit cc7a0bb058 upstream. Both add_slot_store() and remove_slot_store() try to fix up the drc_name copied from the store buffer by placing a NUL terminator at nbyte + 1 or in place of a '\n' if present. However, the static buffer that we copy the drc_name data into is not zeroed and can contain anything past the n-th byte. This is problematic if a '\n' byte appears in that buffer after nbytes and the string copied into the store buffer was not NUL terminated to start with as the strchr() search for a '\n' byte will mark this incorrectly as the end of the drc_name string resulting in a drc_name string that contains garbage data after the n-th byte. Additionally it will cause us to overwrite that '\n' byte on the stack with NUL, potentially corrupting data on the stack. The following debugging shows an example of the drmgr utility writing "PHB 4543" to the add_slot sysfs attribute, but add_slot_store() logging a corrupted string value. drmgr: drmgr: -c phb -a -s PHB 4543 -d 1 add_slot_store: drc_name = PHB 4543°|<82>!, rc = -19 Fix this by using strscpy() instead of memcpy() to ensure the string is NUL terminated when copied into the static drc_name buffer. Further, since the string is now NUL terminated the code only needs to change '\n' to '\0' when present. Cc: stable@vger.kernel.org Signed-off-by: Tyrel Datwyler <tyreld@linux.ibm.com> [mpe: Reformat change log and add mention of possible stack corruption] Signed-off-by: Michael Ellerman <mpe@ellerman.id.au> Link: https://lore.kernel.org/r/20210315214821.452959-1-tyreld@linux.ibm.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-03-25 09:04:16 +01:00
..
controller	PCI: mediatek: Add missing of_node_put() to fix reference leak	2021-03-17 17:06:24 +01:00
endpoint
hotplug	PCI: rpadlpar: Fix potential drc_name corruption in store functions	2021-03-25 09:04:16 +01:00
pcie	PCI/LINK: Remove bandwidth notification	2021-03-17 17:06:24 +01:00
switch
access.c
ats.c
bus.c
ecam.c	PCI/ACPI: Add Ampere Altra SOC MCFG quirk	2020-09-17 12:27:43 -05:00
host-bridge.c
iov.c	PCI/IOV: Mark VFs as not implementing PCI_COMMAND_MEMORY	2020-09-21 14:42:11 -06:00
irq.c
Kconfig	pci-v5.10-changes	2020-10-22 12:41:00 -07:00
Makefile
mmap.c
msi.c
of.c
p2pdma.c	pci-v5.10-changes	2020-10-22 12:41:00 -07:00
pci-acpi.c	PM: ACPI: PCI: Drop acpi_pm_set_bridge_wakeup()	2020-12-30 11:54:05 +01:00
pci-bridge-emul.c	PCI: pci-bridge-emul: Fix array overruns, improve safety	2021-03-04 11:38:15 +01:00
pci-bridge-emul.h
pci-driver.c	pci-v5.10-changes	2020-10-22 12:41:00 -07:00
pci-label.c
pci-mid.c
pci-pf-stub.c	PCI/IOV: Simplify pci-pf-stub with module_pci_driver()	2020-09-17 12:40:20 -05:00
pci-stub.c
pci-sysfs.c	Merge branch 'pci/misc'	2020-10-21 09:58:36 -05:00
pci.c	PCI: Fix pci_register_io_range() memory leak	2021-03-17 17:06:25 +01:00
pci.h	PCI/PM: Revert "PCI/PM: Apply D2 delay as milliseconds, not microseconds"	2020-09-30 17:01:46 -05:00
probe.c	Merge branch 'remotes/lorenzo/pci/dwc'	2020-10-21 09:58:39 -05:00
proc.c
quirks.c	PCI: Add function 1 DMA alias quirk for Marvell 9215 SATA controller	2021-03-11 14:17:26 +01:00
remove.c
rom.c
search.c
setup-bus.c
setup-irq.c
setup-res.c	PCI: Decline to resize resources if boot config must be preserved	2021-03-04 11:37:18 +01:00
slot.c	PCI: Fix pci_slot_release() NULL pointer dereference	2020-12-30 11:54:28 +01:00
syscall.c	PCI: Align checking of syscall user config accessors	2021-03-04 11:38:12 +01:00
vc.c
vpd.c
xen-pcifront.c	dma-mapping: split <linux/dma-mapping.h>	2020-10-06 07:07:03 +02:00