[PATCH] xenbus: preserve terminator when splitting directory strings

[Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>]

xenbus_directory() gets a reply buffer that xenbus_comms.c
null-terminates at body[len]. split_strings() counts strings using
that terminator, but then copies only len bytes into its combined
pointer/string allocation.

If a malformed or unexpected directory reply does not carry a final NUL
within the advertised length, the relocated last string is left
unterminated. Callers then treat the entries as C strings and can read
past the allocation.

Allocate and copy the transport-added terminator as part of the
relocated string block. This preserves current parsing behavior while
keeping every returned entry NUL-terminated.

Signed-off-by: Yousef Alhouseen <alhouseenyousef@xxxxxxxxx>
---
 drivers/xen/xenbus/xenbus_xs.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/xen/xenbus/xenbus_xs.c b/drivers/xen/xenbus/xenbus_xs.c
index c202e7c55..05b758fff 100644
--- a/drivers/xen/xenbus/xenbus_xs.c
+++ b/drivers/xen/xenbus/xenbus_xs.c
@@ -420,13 +420,13 @@ static char **split_strings(char *strings, unsigned int 
len, unsigned int *num)
        /* Count the strings. */
        *num = count_strings(strings, len);
 
-       /* Transfer to one big alloc for easy freeing. */
-       ret = kmalloc(*num * sizeof(char *) + len, GFP_NOIO | __GFP_HIGH);
+       /* Transfer to one big alloc for easy freeing. Keep the extra NUL. */
+       ret = kmalloc(*num * sizeof(char *) + len + 1, GFP_NOIO | __GFP_HIGH);
        if (!ret) {
                kfree(strings);
                return ERR_PTR(-ENOMEM);
        }
-       memcpy(&ret[*num], strings, len);
+       memcpy(&ret[*num], strings, len + 1);
        kfree(strings);
 
        strings = (char *)&ret[*num];
-- 
2.54.0