Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e8a79c9e authored by Heiko Carstens's avatar Heiko Carstens Committed by Martin Schwidefsky
Browse files

[S390] call home: fix string length handling 



After copying uts->nodename to the static nodename array the static
version isn't necessarily zero termininated, since the size of the
array is one byte too short.
Afterwards doing strncat(data, nodename, strlen(nodename)); may copy
an arbitrary large amount of bytes.
Fix this by getting rid of the static array and using strncat with
proper length limit.

Signed-off-by: default avatarHeiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: default avatarMartin Schwidefsky <schwidefsky@de.ibm.com>
parent 4a0fb4c4

drivers/s390/char/sclp_async.c

+6 −8
Original line number Diff line number Diff line
@@ -26,7 +26,6 @@ static struct sclp_async_sccb *sccb; 
static int sclp_async_send_wait(char *message);

static struct ctl_table_header *callhome_sysctl_header;

static DEFINE_SPINLOCK(sclp_async_lock);

static char nodename[64];

#define SCLP_NORMAL_WRITE	0x00



struct async_evbuf {
@@ -52,7 +51,8 @@ static struct sclp_register sclp_async_register = { 
static int call_home_on_panic(struct notifier_block *self,

			      unsigned long event, void *data)

{

		strncat(data, nodename, strlen(nodename));

	strncat(data, init_utsname()->nodename,

		sizeof(init_utsname()->nodename));

	sclp_async_send_wait(data);

	return NOTIFY_DONE;

}
@@ -183,9 +183,7 @@ static int __init sclp_async_init(void) 
		goto out_mem;

	rc = atomic_notifier_chain_register(&panic_notifier_list,

					    &call_home_panic_nb);

	if (rc)

		goto out_mem;

	strncpy(nodename, init_utsname()->nodename, 64);

	if (!rc)

		goto out;

out_mem:

	kfree(request);