From 8297ca5e8c70ddb58cf03cd0411929ab87a44860 Mon Sep 17 00:00:00 2001 From: Ole Wiedemann Date: Fri, 13 Dec 2019 14:10:32 +0100 Subject: staging: android: ashmem: Replace strcpy with strscpy Replaced strcpy call with safer strscpy call with given length. This elimates the need to manually null-terminate the given string, since strscpy will null terminate the destination anyway.: Signed-off-by: Ole Wiedemann Co-developed-by: Sebastian Scherbel Signed-off-by: Sebastian Scherbel Acked-by: Christian Brauner Acked-by: Joel Fernandes (Google) Acked-by: Todd Kjos Link: https://lore.kernel.org/r/20191213131032.22579-1-ole.wiedemann@fau.de Signed-off-by: Greg Kroah-Hartman --- drivers/staging/android/ashmem.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) (limited to 'drivers/staging/android') diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c index 74d497d39c5a..5891d0744a76 100644 --- a/drivers/staging/android/ashmem.c +++ b/drivers/staging/android/ashmem.c @@ -537,14 +537,14 @@ static int set_name(struct ashmem_area *asma, void __user *name) len = strncpy_from_user(local_name, name, ASHMEM_NAME_LEN); if (len < 0) return len; - if (len == ASHMEM_NAME_LEN) - local_name[ASHMEM_NAME_LEN - 1] = '\0'; + mutex_lock(&ashmem_mutex); /* cannot change an existing mapping's name */ if (asma->file) ret = -EINVAL; else - strcpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name); + strscpy(asma->name + ASHMEM_NAME_PREFIX_LEN, local_name, + ASHMEM_NAME_LEN); mutex_unlock(&ashmem_mutex); return ret; -- cgit v1.2.3-59-g8ed1b