strcpy() performs no bounds checking on the destination buffer. This could result in linear overflows beyond the end of the buffer, leading to all kinds of misbehaviors.[1] [1]: https://www.kernel.org/doc/html/latest/process/deprecated.html#strcpy Signed-off-by: Nitin Joshi <nitjoshi@xxxxxxxxx> --- drivers/platform/x86/thinkpad_acpi.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c index 2cfb2ac3f465..c9e2dfb942ec 100644 --- a/drivers/platform/x86/thinkpad_acpi.c +++ b/drivers/platform/x86/thinkpad_acpi.c @@ -11681,7 +11681,7 @@ static int __init set_ibm_param(const char *val, const struct kernel_param *kp) if (strcmp(ibm->name, kp->name) == 0 && ibm->write) { if (strlen(val) > sizeof(ibms_init[i].param) - 1) return -ENOSPC; - strcpy(ibms_init[i].param, val); + strscpy(ibms_init[i].param, val); return 0; } } -- 2.43.0
