When sending message in send_secondary_console_msg(), the length is not
include the NUL byte, and also not copy NUL to 'ipc_buffer'.
When receive message in recv_secondary_console_msg(), the 'cnt' also
excludes NUL.
So when get string from ipc_buffer, it may not be NUL terminated.
Then use memcpy() instead of strcpy(), and set last byte NUL.
Signed-off-by: Chen Gang <gang.chen@xxxxxxxxxxx>
---
arch/alpha/kernel/smp.c | 3 ++-
1 files changed, 2 insertions(+), 1 deletions(-)
diff --git a/arch/alpha/kernel/smp.c b/arch/alpha/kernel/smp.c
index 7b60834..d3d2040 100644
--- a/arch/alpha/kernel/smp.c
+++ b/arch/alpha/kernel/smp.c
@@ -266,7 +266,8 @@ recv_secondary_console_msg(void)
else {
cp1 = (char *) &cpu->ipc_buffer[11];
cp2 = buf;
- strcpy(cp2, cp1);
+ memcpy(cp2, cp1, cnt);
+ cp2[cnt] = '\0';
while ((cp2 = strchr(cp2, '\r')) != 0) {
*cp2 = ' ';
--
1.7.7.6
--
To unsubscribe from this list: send the line "unsubscribe linux-arch" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
