tjh.dev / kernel
Linux kernel mirror (for testing) git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel os linux
1
fork

Configure Feed

Select the types of activity you want to include in your feed.

platform/x86: dell-wmi-sysman: bound enumeration string aggregation

populate_enum_data() aggregates firmware-provided value-modifier
and possible-value strings into fixed 512-byte struct members.
The current code bounds each individual source string but then
appends every string and separator with raw strcat() and no
remaining-space check.

Switch the aggregation loops to a bounded append helper and
reject enumeration packages whose combined strings do not fit
in the destination buffers.

Fixes: e8a60aa7404b ("platform/x86: Introduce support for Systems Management Driver over WMI for Dell Systems")
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Link: https://patch.msgid.link/20260408084501.1-dell-wmi-sysman-v2-pengpeng@iscas.ac.cn
[ij: add include]
Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
Signed-off-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>

authored by

Pengpeng Hou and committed by
Ilpo Järvinen 3c34471c e8c59736

+28 -6
+28 -6
drivers/platform/x86/dell/dell-wmi-sysman/enum-attributes.c
··· 6 6 * Copyright (c) 2020 Dell Inc. 7 7 */ 8 8 9 + #include <linux/bug.h> 10 + 9 11 #include "dell-wmi-sysman.h" 10 12 11 13 get_instance_id(enumeration); 14 + 15 + static int append_enum_string(char *dest, const char *src) 16 + { 17 + size_t dest_len = strlen(dest); 18 + ssize_t copied; 19 + 20 + if (WARN_ON_ONCE(dest_len >= MAX_BUFF)) 21 + return -EINVAL; 22 + 23 + copied = strscpy(dest + dest_len, src, MAX_BUFF - dest_len); 24 + if (copied < 0) 25 + return -EINVAL; 26 + 27 + dest_len += copied; 28 + copied = strscpy(dest + dest_len, ";", MAX_BUFF - dest_len); 29 + if (copied < 0) 30 + return -EINVAL; 31 + 32 + return 0; 33 + } 12 34 13 35 static ssize_t current_value_show(struct kobject *kobj, struct kobj_attribute *attr, char *buf) 14 36 { ··· 198 176 return -EINVAL; 199 177 if (check_property_type(enumeration, next_obj, ACPI_TYPE_STRING)) 200 178 return -EINVAL; 201 - strcat(wmi_priv.enumeration_data[instance_id].dell_value_modifier, 202 - enumeration_obj[next_obj++].string.pointer); 203 - strcat(wmi_priv.enumeration_data[instance_id].dell_value_modifier, ";"); 179 + if (append_enum_string(wmi_priv.enumeration_data[instance_id].dell_value_modifier, 180 + enumeration_obj[next_obj++].string.pointer)) 181 + return -EINVAL; 204 182 } 205 183 206 184 if (next_obj >= enum_property_count) ··· 215 193 return -EINVAL; 216 194 if (check_property_type(enumeration, next_obj, ACPI_TYPE_STRING)) 217 195 return -EINVAL; 218 - strcat(wmi_priv.enumeration_data[instance_id].possible_values, 219 - enumeration_obj[next_obj++].string.pointer); 220 - strcat(wmi_priv.enumeration_data[instance_id].possible_values, ";"); 196 + if (append_enum_string(wmi_priv.enumeration_data[instance_id].possible_values, 197 + enumeration_obj[next_obj++].string.pointer)) 198 + return -EINVAL; 221 199 } 222 200 223 201 return sysfs_create_group(attr_name_kobj, &enumeration_attr_group);