Skip to content

Commit 300a0cf

Browse files
tobluxgregkh
authored andcommitted
cdx: Fix off-by-one error in cdx_rpmsg_probe()
In cdx_rpmsg_probe(), strscpy() is incorrectly called with the length of the source string (excluding the NUL terminator) rather than the size of the destination buffer. This results in one character less being copied from 'cdx_rpmsg_id_table[0].name' to 'chinfo.name'. Use the destination buffer size instead to ensure the name is copied correctly. Cc: stable <stable@kernel.org> Fixes: 2a22692 ("cdx: add rpmsg communication channel for CDX") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Link: https://lore.kernel.org/r/20250806090512.121260-2-thorsten.blum@linux.dev Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent 1ca6106 commit 300a0cf

1 file changed

Lines changed: 1 addition & 2 deletions

File tree

drivers/cdx/controller/cdx_rpmsg.c

Lines changed: 1 addition & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -129,8 +129,7 @@ static int cdx_rpmsg_probe(struct rpmsg_device *rpdev)
129129

130130
chinfo.src = RPMSG_ADDR_ANY;
131131
chinfo.dst = rpdev->dst;
132-
strscpy(chinfo.name, cdx_rpmsg_id_table[0].name,
133-
strlen(cdx_rpmsg_id_table[0].name));
132+
strscpy(chinfo.name, cdx_rpmsg_id_table[0].name, sizeof(chinfo.name));
134133

135134
cdx_mcdi->ept = rpmsg_create_ept(rpdev, cdx_rpmsg_cb, NULL, chinfo);
136135
if (!cdx_mcdi->ept) {

0 commit comments

Comments
 (0)