thermal/core: Potential buffer overflow in thermal_build_list_of_policies()
authorDan Carpenter <dan.carpenter@oracle.com>
Thu, 16 Sep 2021 13:13:42 +0000 (16:13 +0300)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Wed, 6 Oct 2021 13:05:06 +0000 (15:05 +0200)
commit31710aedd4b8be74ec7159f236d8fbda18e07472
treed4d32b228524de6436a1ea61a0f2a2138c9c99e3
parentb4599172710265af176d33d2a979a84faed41397
thermal/core: Potential buffer overflow in thermal_build_list_of_policies()

[ Upstream commit 1bb30b20b49773369c299d4d6c65227201328663 ]

After printing the list of thermal governors, then this function prints
a newline character.  The problem is that "size" has not been updated
after printing the last governor.  This means that it can write one
character (the NUL terminator) beyond the end of the buffer.

Get rid of the "size" variable and just use "PAGE_SIZE - count" directly.

Fixes: 1b4f48494eb2 ("thermal: core: group functions related to governor handling")
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Daniel Lezcano <daniel.lezcano@linaro.org>
Link: https://lore.kernel.org/r/20210916131342.GB25094@kili
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/thermal/thermal_core.c