thermal/core: Potential buffer overflow in thermal_build_list_of_policies()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 16 Sep 2021 13:13:42 +0000 (16:13 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 30 Sep 2021 08:11:04 +0000 (10:11 +0200)
commit8cba4c2698e282aa03948b74ebc259925c873402
tree3adb7de6f2a4c1c94347100ce698b5db0478a451
parent215df4349916a62a03b1899ded08e7a9d2d40480
thermal/core: Potential buffer overflow in thermal_build_list_of_policies()

[ Upstream commit 1bb30b20b49773369c299d4d6c65227201328663 ]

After printing the list of thermal governors, then this function prints
a newline character.  The problem is that "size" has not been updated
after printing the last governor.  This means that it can write one
character (the NUL terminator) beyond the end of the buffer.

Get rid of the "size" variable and just use "PAGE_SIZE - count" directly.

Fixes: 1b4f48494eb2 ("thermal: core: group functions related to governor handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210916131342.GB25094@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/thermal/thermal_core.c