hostfs: fix string handling in __dentry_name()

strcpy() should not be used with destination potentially overlapping
the source; what's more, strscpy() in there is pointless - we already
know the amount we want to copy; might as well use memcpy().

Fixes: c278e81b8a02 "hostfs: Remove open coded strcpy()"
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

diff --git a/fs/hostfs/hostfs_kern.c b/fs/hostfs/hostfs_kern.c
index 7e51d2cec64b48aa9e43caf40d6eebdd88eb58c6..bd6503b731426443379cbe696f294200746b003e 100644 (file)
--- a/fs/hostfs/hostfs_kern.c
+++ b/fs/hostfs/hostfs_kern.c
@@ -95,32 +95,17 @@ __uml_setup("hostfs=", hostfs_args,
 static char *__dentry_name(struct dentry *dentry, char *name)
 {
        char *p = dentry_path_raw(dentry, name, PATH_MAX);
-       char *root;
-       size_t len;
-       struct hostfs_fs_info *fsi;
-
-       fsi = dentry->d_sb->s_fs_info;
-       root = fsi->host_root_path;
-       len = strlen(root);
-       if (IS_ERR(p)) {
-               __putname(name);
-               return NULL;
-       }
-
-       /*
-        * This function relies on the fact that dentry_path_raw() will place
-        * the path name at the end of the provided buffer.
-        */
-       BUG_ON(p + strlen(p) + 1 != name + PATH_MAX);
+       struct hostfs_fs_info *fsi = dentry->d_sb->s_fs_info;
+       char *root = fsi->host_root_path;
+       size_t len = strlen(root);
 
-       strscpy(name, root, PATH_MAX);
-       if (len > p - name) {
+       if (IS_ERR(p) || len > p - name) {
                __putname(name);
                return NULL;
        }
 
-       if (p > name + len)
-               strcpy(name + len, p);
+       memcpy(name, root, len);
+       memmove(name + len, p, name + PATH_MAX - p);
 
        return name;
 }