[lvc-project] [PATCH 5.10] scsi: gdth: ensure event string is NUL-terminated

[Daniil Iskhakov]

No upstream commit exists for this patch. GDT driver was removed from
kernel.

For GDT_PCIMPR controllers, the driver copies up to 256 bytes from the
controller event buffer and later handles the result as a C string.

If the firmware does not provide a NUL byte within the buffer,
gdth_log_event() may read beyond event_string through printk() and
sprintf().

Force the last byte of event_string to NUL after copying it from the
controller. This preserves shorter strings and safely truncates an
unterminated full-length event.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Co-developed-by: Agalakov Daniil <ade at amicon.ru>
Signed-off-by: Agalakov Daniil <ade at amicon.ru>
Signed-off-by: Daniil Iskhakov <dish at amicon.ru>
---
 drivers/scsi/gdth.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 5d801388680b..744fc1bf1855 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -2562,6 +2562,7 @@ static irqreturn_t __gdth_interrupt(gdth_ha_str *ha,
                         if (ha->dvr.event_string[i] == 0)
                             break;
                     }
+					ha->dvr.event_string[255] = 0;
                 }
             }
             writeb(0xff, &dp6m_ptr->i960r.edoor_reg);
-- 
2.43.0