Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Armin Wolf <W_Armin@gmx.de>
To:     rafael@kernel.org, lenb@kernel.org
Cc:     linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 0/4] ACPI: battery: Fix various string handling issues
Date:   Sat, 14 Jan 2023 09:50:49 +0100
Message-Id: <20230114085053.72059-1-W_Armin@gmx.de>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:amZsE0b69sw=;gDg8sThy349vKQlrCIIxsk5AP6V
 mosjPcZUUtJSueFkdGv/tQTqKtXjSAiUFUJDhNkQ3FWbAo4HVL9kGVyCEcj2H5eO/ScfJ9gVR
 QrMNfuV03gHjuUjJ3yJvg3uAPt5OyPIuEN40lBn2Qz0XzzgWVyd4dplBMT/4bsbz3YffU51Ul
 iAOkL/7XFcSvG63voKR+dB34fDLHwMKSS5vHiPDTFqx6d+gDAoILJMFuQGeG1RqFeui8uFm/U
 Xbd0h46yPiwfxsHSR7AqV/4NvLjQtXunkC+dsjz6PZT8G80I3561BPWSb3IrhcCxyRjFPN1rv
 uBNxzV+wS3onXis0pB20C/XeVufull872c+RAPh0RJ+JuDaMZCdzZBnEpMPRYH48qFM6HuJkH
 c+kyTreV/OHhH5l4sxWdKXHCxq6BDc92FkZciw/7gZRMsxZHQgpHuAGc55wBpqmn3bpc4SmH7
 W3/ro8hdkPGvcy7/wdW17axZdOz1442V92SBxV/q1uxKjilPhwRMd25b68mDxZxuWVIKY2Rt4
 z5ZZxqo0WKpkjIGw/APT3ueMKmpWIY07Jxq7mU/9NtKaafDppblmHtN2qqk8KQgsEMGHGVEAw
 Y/5osflTaYIO7pjnXuSoJGLDi2Lp0UF0OqPrbb1si58MQbUsJj53yeFwZAnX0Se+g4fUURK+7
 LRD0Dp5ViW2SezSQJrl0PcGDMqJSj95MN2LjOx6iiRnT4j6bTXOpSZD8CPz4wZfUjBRLvd7bD
 3M1jfhRz+scJOJ8h7vS4C/4jHvLdzP2ORN05m5UUd5dla+dWP8xi7JSH43g8aAz0t6Mm413dU
 wI7xtrtch6pvKBfNWdNWgeaEnB3f88Xv5l4wWvh2k1lubPydLfVJGxYmRkeh9s8I1mOOuXlrU
 l3JQy3MZxl7qHjcL6lBF7DhDOZmaH7BTiXeyMavb7uHCbp4ZDddO7YMJqYI7QAOnPPDzUV3da
 8cUoMNyQoW/YoGOqYJCEhBejFVc=
Precedence: bulk

On my Dell Inspiron 3505, the battery model name was displayed
differently than when running Windows. While i first suspected an
ACPI issue, it turned out that the real reason was the ACPI battery
driver failing to handle strings larger than 32 bytes.

This caused the model name of the battery (35 bytes long, hex string)
to miss proper NUL-termination, causing a buffer overread later.
Luckely, a valid string was stored right after the now invalid string,
appending only the battery serial number to the original model name.

The first patch deals with this issues, while the second patch fixes
another problem which could happen when handling buffers. The third
patch adds a minor improvement to the string handling code  and the
fourth patch finally increases the maximum string length to avoid
truncating such larger strings.

The patch series was tested on a Dell Inspiron 3505 and appears
to work properly.

Armin Wolf (4):
  ACPI: battery: Fix missing NUL-termination with large strings
  ACPI: battery: Fix buffer overread if not NUL-terminated
  ACPI: battery: Replace strncpy() with strscpy()
  ACPI: battery: Increase maximum string length

 drivers/acpi/battery.c | 36 +++++++++++++++++++++++-------------
 1 file changed, 23 insertions(+), 13 deletions(-)

=2D-
2.30.2