[PATCH] mcb: fix kasan read slab out of bounds

[Filip Jensen]

Fixes the following kasan bug report reproducible when probing the
driver:

slab-out-of-bounds in string_nocheck lib/vsprintf.c:655
slab-out-of-bounds in string+0x396/0x440 lib/vsprintf.c:737
Read of size 1 at addr ffff88810dd32f94 by task modprobe/661

It is caused for passing snprintf a not null terminated string as a
parameter but in the format string expecting one ("%s"), thus making
it read pass the valid data.

Another solution could be giving a length to the snprintf parameter:
        snprintf(bus->name,CHAMELEON_FILENAME_LEN +
1,"%.*s",CHAMELEON_FILENAME_LEN,header->filename);
However, this solution seems less readable and since there is no need
to format the input, apart from converting it into a right C string, a
simple memcpy is here proposed.

Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@xxxxxxxxxx>
Signed-off-by: Filip Jensen <dev-Felipe.Jensen@xxxxxxxxxx>
---
 drivers/mcb/mcb-parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index bf0d7d58c8b0..85dba7ec1409 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -201,8 +201,8 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
 	bus->revision = header->revision;
 	bus->model = header->model;
 	bus->minor = header->minor;
-	snprintf(bus->name, CHAMELEON_FILENAME_LEN + 1, "%s",
-		 header->filename);
+	memcpy(bus->name, header->filename, CHAMELEON_FILENAME_LEN);
+	bus->name[CHAMELEON_FILENAME_LEN] = '\0';
 
 	bar_count = chameleon_get_bar(&p, mapbase, &cb);
 	if (bar_count < 0) {
-- 
2.34.1