parse_system_parameter_string() copies the shared processor attribute sysparm into a fixed local work buffer one byte at a time, but it never checks whether the next byte still fits. A long token without an early comma or NUL can therefore run past SPLPAR_MAXLENGTH.

Stop parsing once the local token buffer is full instead of writing past the fixed destination.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/powerpc/platforms/pseries/lparcfg.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
index 8821c378bfff..1bf2312f3e04 100644
--- a/arch/powerpc/platforms/pseries/lparcfg.c
+++ b/arch/powerpc/platforms/pseries/lparcfg.c
@@ -418,6 +418,10 @@ static void parse_system_parameter_string(struct seq_file *m)
 		w_idx = 0;
 		idx = 0;
 		while ((*local_buffer) && (idx < splpar_strlen)) {
+			if (w_idx >= SPLPAR_MAXLENGTH - 1) {
+				pr_warn_once("lparcfg: shared processor attribute token is too long\n");
+				break;
+			}
 			workbuffer[w_idx++] = local_buffer[idx++];
 			if ((local_buffer[idx] == ',')
 			    || (local_buffer[idx] == '\0')) {
-- 
2.50.1 (Apple Git-155)