parse_system_parameter_string() copies the shared processor attribute sysparm into a fixed local work buffer one byte at a time, but it never checks whether the next byte still fits. A long token without an early comma or NUL can therefore run past SPLPAR_MAXLENGTH.
Stop parsing once the local token buffer is full instead of writing past the fixed destination. Signed-off-by: Pengpeng Hou <[email protected]> --- arch/powerpc/platforms/pseries/lparcfg.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c index 8821c378bfff..1bf2312f3e04 100644 --- a/arch/powerpc/platforms/pseries/lparcfg.c +++ b/arch/powerpc/platforms/pseries/lparcfg.c @@ -418,6 +418,10 @@ static void parse_system_parameter_string(struct seq_file *m) w_idx = 0; idx = 0; while ((*local_buffer) && (idx < splpar_strlen)) { + if (w_idx >= SPLPAR_MAXLENGTH - 1) { + pr_warn_once("lparcfg: shared processor attribute token is too long\n"); + break; + } workbuffer[w_idx++] = local_buffer[idx++]; if ((local_buffer[idx] == ',') || (local_buffer[idx] == '\0')) { -- 2.50.1 (Apple Git-155)
