From: Kamenee Arumugam <kamenee.arumugam@intel.com>
Date: Mon, 28 Aug 2017 11:23:33 -0700
Subject: IB/qib: Stricter bounds checking for copy to buffer
Patch-mainline: v4.14-rc1
Git-commit: 6167a5b4b5f97d9fc09a99842bd3aa149654ffcf
References: bsc#1027067 FATE#322649
Replace 'strcpy' with 'strncpy' to restrict the number
of bytes copied to the buffer.
Reviewed-by: Michael J. Ruhl <michael.j.ruhl@intel.com>
Signed-off-by: Kamenee Arumugam <kamenee.arumugam@intel.com>
Signed-off-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Acked-by: Thomas Bogendoerfer <tbogendoerfer@suse.de>
---
drivers/infiniband/hw/qib/qib_iba7322.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
--- a/drivers/infiniband/hw/qib/qib_iba7322.c
+++ b/drivers/infiniband/hw/qib/qib_iba7322.c
@@ -6175,7 +6175,7 @@ static int setup_txselect(const char *st
unsigned long val;
char *n;
- if (strlen(str) >= MAX_ATTEN_LEN) {
+ if (strlen(str) >= ARRAY_SIZE(txselect_list)) {
pr_info("txselect_values string too long\n");
return -ENOSPC;
}
@@ -6186,7 +6186,7 @@ static int setup_txselect(const char *st
TXDDS_TABLE_SZ + TXDDS_EXTRA_SZ + TXDDS_MFG_SZ);
return -EINVAL;
}
- strcpy(txselect_list, str);
+ strncpy(txselect_list, str, ARRAY_SIZE(txselect_list) - 1);
list_for_each_entry(dd, &qib_dev_list, list)
if (dd->deviceid == PCI_DEVICE_ID_QLOGIC_IB_7322)