From: Peter Zmanovsky The ACPI string object's .length field holds the byte count of the string excluding the NULL terminator. fch_misc_setup() allocates obj->string.length bytes for the clock name buffer and then passes that same value as the size argument to strscpy(). Since strscpy() writes at most (size - 1) non-null characters before appending NULL, the last byte of the clock name is silently dropped. Allocate obj->string.length + 1 bytes and pass that same count to strscpy() so the complete string is preserved. Found by Linux Verification Center (linuxtesting.org) with SVACE. Fixes: 7fdb98e8a768b ("ACPI: APD: Add a fmw property clk-name") Signed-off-by: Peter Zmanovsky --- drivers/acpi/acpi_apd.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/acpi/acpi_apd.c b/drivers/acpi/acpi_apd.c index e7366fcb76ee..f2012dfdc511 100644 --- a/drivers/acpi/acpi_apd.c +++ b/drivers/acpi/acpi_apd.c @@ -82,12 +82,12 @@ static int fch_misc_setup(struct apd_private_data *pdata) return -ENOENT; if (!acpi_dev_get_property(adev, "clk-name", ACPI_TYPE_STRING, &obj)) { - clk_data->name = devm_kzalloc(&adev->dev, obj->string.length, + clk_data->name = devm_kzalloc(&adev->dev, obj->string.length + 1, GFP_KERNEL); if (!clk_data->name) return -ENOMEM; - strscpy(clk_data->name, obj->string.pointer, obj->string.length); + strscpy(clk_data->name, obj->string.pointer, obj->string.length + 1); } else { /* Set default name to mclk if entry missing in firmware */ clk_data->name = "mclk"; -- 2.43.0