[PATCH] platform/x86: asus-laptop: terminate the INIT model name

[Kang Chen]

asus_laptop_get_info() treats the buffer returned by INIT as a C string
and passes it to kstrdup().  ACPICA zeroes the tail of the buffer data
area only up to the native word boundary, so a buffer whose length is a
multiple of the word size can be left without a NUL terminator.
kstrdup() and the following pr_notice() then read past the allocation.

Copy the string and buffer cases with kmemdup_nul() using the length
reported by ACPICA, which guarantees a terminator.  Reject a missing
INIT object explicitly before copying.  Also drop the DSDT table
reference on the error paths and in remove.

Fixes: 85091b718969b ("asus-laptop: add base driver")
Signed-off-by: Kang Chen <k.chen@xxxxxxxxxxxxxxxx>
---
 drivers/platform/x86/asus-laptop.c | 26 +++++++++++++++++++++++---
 1 file changed, 23 insertions(+), 3 deletions(-)

diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index e4f20ab5250a..eb6c182d862d 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -1667,6 +1667,14 @@ static struct platform_driver platform_driver = {
 	},
 };
 
+static void asus_put_dsdt(struct asus_laptop *asus)
+{
+	if (asus->dsdt_info) {
+		acpi_put_table(asus->dsdt_info);
+		asus->dsdt_info = NULL;
+	}
+}
+
 /*
  * This function is used to initialize the context with right values. In this
  * method, we can make all the detection we want, and modify the asus_laptop
@@ -1678,6 +1686,7 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
 	union acpi_object *model = NULL;
 	unsigned long long bsts_result;
 	char *string = NULL;
+	size_t string_len = 0;
 	acpi_status status;
 
 	/*
@@ -1694,6 +1703,7 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
 	/* We have to write 0 on init this far for all ASUS models */
 	if (write_acpi_int_ret(asus->handle, "INIT", 0, &buffer)) {
 		pr_err("Hotkey initialization failed\n");
+		asus_put_dsdt(asus);
 		return -ENODEV;
 	}
 
@@ -1720,23 +1730,31 @@ static int asus_laptop_get_info(struct asus_laptop *asus)
 		switch (model->type) {
 		case ACPI_TYPE_STRING:
 			string = model->string.pointer;
+			string_len = model->string.length;
 			break;
 		case ACPI_TYPE_BUFFER:
 			string = model->buffer.pointer;
+			string_len = model->buffer.length;
 			break;
 		default:
 			string = "";
 			break;
 		}
 	}
-	asus->name = kstrdup(string, GFP_KERNEL);
+	if (!string) {
+		kfree(buffer.pointer);
+		asus_put_dsdt(asus);
+		return -ENODEV;
+	}
+
+	asus->name = kmemdup_nul(string, string_len, GFP_KERNEL);
 	if (!asus->name) {
 		kfree(buffer.pointer);
+		asus_put_dsdt(asus);
 		return -ENOMEM;
 	}
 
-	if (string)
-		pr_notice("  %s model detected\n", string);
+	pr_notice("  %s model detected\n", asus->name);
 
 	if (!acpi_check_handle(asus->handle, METHOD_WL_STATUS, NULL))
 		asus->have_rsts = true;
@@ -1903,6 +1921,7 @@ static int asus_acpi_probe(struct platform_device *pdev)
 fail_backlight:
 	asus_platform_exit(asus);
 fail_platform:
+	asus_put_dsdt(asus);
 	kfree(asus);
 
 	return result;
@@ -1921,6 +1940,7 @@ static void asus_acpi_remove(struct platform_device *pdev)
 	pega_accel_exit(asus);
 	asus_platform_exit(asus);
 
+	asus_put_dsdt(asus);
 	kfree(asus->name);
 	kfree(asus);
 }
-- 
2.34.1