Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Armin Wolf <W_Armin@gmx.de>
To:     rafael@kernel.org, lenb@kernel.org
Cc:     linux-acpi@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: [PATCH 1/4] ACPI: battery: Fix missing NUL-termination with large strings
Date:   Sat, 14 Jan 2023 09:50:50 +0100
Message-Id: <20230114085053.72059-2-W_Armin@gmx.de>
In-Reply-To: <20230114085053.72059-1-W_Armin@gmx.de>
References: <20230114085053.72059-1-W_Armin@gmx.de>
MIME-Version: 1.0
Content-Transfer-Encoding: quoted-printable
UI-OutboundReport: notjunk:1;M01:P0:95BV4QVoCTE=;Q2azfCmrGSrvVBLlUaLLdyO8IfV
 /j0zeGDUEFJb/Dq+GzOFRCBrqSaqcQag6SPY1/VkamYCWCaCP0vUnn6BcF4q7Yxo5DF8914PZ
 hxIQ2s/MIywNBVPGVdNLFBlu2PtoJto1pFb3xniWmptFzmrjr4xwei1U0EYnxjyCm7yVKkA2g
 ZGXXHXo9kfohtOi36X0nFBSiZOaGaxtMGsRbMTq05Xbej0NsiqSY4yI1GtsQEFEM6lLa7Vi0m
 Kjc5gWZk6o9Vo/6S+RdvrJQ7WhSOEkeCnPoKCOEG0+gMHjUtws10tf2ZcrmOOq4zO1174i5dD
 9Yd2LlhgVQxZYPVpAjQQdnRL7VHu8daZJ1VLHis9kd1fC8tg4gSYWNWLNw1cJCkMVUMgmwQVj
 Xxsirr3WNuqeDdqbOnLJEJ2RlrccTEvHv3NwkQs/B4NAs+Rj42Pilye/PKoTnzlRJe27HFggw
 34DTA2VQ6BDnJv4WjSyPWpXcEqbnFi7QgNQ2Y6uo69ZhJt9hThjrWvwT4oMgDlR2/UtjN9VLv
 UnIX5JRCa5L1hmMmuh0Io9e2Gwaa8vfGqCCEc15frbk6ZpyGhB72Kf5XunD2sCsA/005NUziH
 NDKX7G9Gt/68KMbrfEfFl2aYBONLn1AmxbAKCJmZSd9jB0pUkel1gjsbumg2w68jVmeO4YFJ1
 IHwmyCJWUPs24VX+JZUnaCVx/xYbH/yfkyULzIyDLvK+QByRsp6X9gWHS6XMp7beiYrjbZjf0
 LkF72Ft83ecD7CrZoWSCzEa220PpdJ0TM/bzIXtE+ECP14RqMM77C2bNRcm1KA0SBj5QnM1fv
 VB5H7q4GumTQPS/I7h3LRbJQ9YzraiLnRIqUO8YJWfwPu21Xt/oackE2Shnkwav2g9eaMnnLV
 2S3S4n09x93bN5jKX0SJtJqwMyHd9a5F+JNzNx5unS9GX+Cm6VpTIfpk8REYrbhHw7vGnO1Vs
 nZCLtvg7XCPnxxLYxnU2OYVJs+E=
Precedence: bulk

When encountering a string bigger than the destination buffer (32 bytes),
the string is not properly NUL-terminated, causing buffer overreads later.

This for example happens on the Inspiron 3505, where the battery
model name is larger than 32 bytes, which leads to sysfs showing
the model name together with the serial number string (which is
NUL-terminated and thus prevents worse).

Fix this by using strscpy() which ensures that the result is
always NUL-terminated.

Signed-off-by: Armin Wolf <W_Armin@gmx.de>
=2D--
 drivers/acpi/battery.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
index f4badcdde76e..fb64bd217d82 100644
=2D-- a/drivers/acpi/battery.c
+++ b/drivers/acpi/battery.c
@@ -440,7 +440,7 @@ static int extract_package(struct acpi_battery *batter=
y,

 			if (element->type =3D=3D ACPI_TYPE_STRING ||
 			    element->type =3D=3D ACPI_TYPE_BUFFER)
-				strncpy(ptr, element->string.pointer, 32);
+				strscpy(ptr, element->string.pointer, 32);
 			else if (element->type =3D=3D ACPI_TYPE_INTEGER) {
 				strncpy(ptr, (u8 *)&element->integer.value,
 					sizeof(u64));
=2D-
2.30.2