[PATCH] ACPI: APD: fix off-by-one when copying clk-name property

[nathan2049]

From: Peter Zmanovsky <zzz4android@xxxxxxxxx>

The ACPI string object's .length field holds the byte count of the
string excluding the NULL terminator.  fch_misc_setup() allocates
obj->string.length bytes for the clock name buffer and then passes
that same value as the size argument to strscpy().  Since strscpy()
writes at most (size - 1) non-null characters before appending NULL,
the last byte of the clock name is silently dropped.

Allocate obj->string.length + 1 bytes and pass that same count to
strscpy() so the complete string is preserved.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 7fdb98e8a768b ("ACPI: APD: Add a fmw property clk-name")
Signed-off-by: Peter Zmanovsky <zzz4android@xxxxxxxxx>
---
 drivers/acpi/acpi_apd.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/acpi_apd.c b/drivers/acpi/acpi_apd.c
index e7366fcb76ee..f2012dfdc511 100644
--- a/drivers/acpi/acpi_apd.c
+++ b/drivers/acpi/acpi_apd.c
@@ -82,12 +82,12 @@ static int fch_misc_setup(struct apd_private_data *pdata)
 		return -ENOENT;
 
 	if (!acpi_dev_get_property(adev, "clk-name", ACPI_TYPE_STRING, &obj)) {
-		clk_data->name = devm_kzalloc(&adev->dev, obj->string.length,
+		clk_data->name = devm_kzalloc(&adev->dev, obj->string.length + 1,
 					      GFP_KERNEL);
 		if (!clk_data->name)
 			return -ENOMEM;
 
-		strscpy(clk_data->name, obj->string.pointer, obj->string.length);
+		strscpy(clk_data->name, obj->string.pointer, obj->string.length + 1);
 	} else {
 		/* Set default name to mclk if entry missing in firmware */
 		clk_data->name = "mclk";
-- 
2.43.0