From: Martin Wilck <mwilck@suse.com>

Date: Mon, 27 Nov 2017 23:47:34 +0100

Subject: scsi: scsi_devinfo: handle non-terminated strings

Git-commit: ba69ead9e9e9bb3cec5faf03526c36764ac8942a

Patch-mainline: v4.15-rc4

References: bsc#1062941, bsc#1037404, bsc#1012523, bsc#1038299

devinfo->vendor and devinfo->model aren't necessarily

zero-terminated.

Fixes: b8018b973c7c "scsi_devinfo: fixup string compare"

Signed-off-by: Martin Wilck <mwilck@suse.com>

Reviewed-by: Bart Van Assche <bart.vanassche@wdc.com>

Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>

---

 drivers/scsi/scsi_devinfo.c | 5 +++--

 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c

index 78d4aa8df675..b256d4cbd3ad 100644

--- a/drivers/scsi/scsi_devinfo.c

+++ b/drivers/scsi/scsi_devinfo.c

@@ -458,7 +458,8 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,

 			/*

 			 * vendor strings must be an exact match

 			 */

-			if (vmax != strlen(devinfo->vendor) ||

+			if (vmax != strnlen(devinfo->vendor,

+					    sizeof(devinfo->vendor)) ||

 			    memcmp(devinfo->vendor, vskip, vmax))

 				continue;

@@ -466,7 +467,7 @@ static struct scsi_dev_info_list *scsi_dev_info_list_find(const char *vendor,

 			 * @model specifies the full string, and

 			 * must be larger or equal to devinfo->model

 			 */

-			mlen = strlen(devinfo->model);

+			mlen = strnlen(devinfo->model, sizeof(devinfo->model));

 			if (mmax < mlen || memcmp(devinfo->model, mskip, mlen))

 				continue;

 			return devinfo;