diff --git a/drivers/xen/xenbus/xenbus_probe.c b/drivers/xen/xenbus/xenbus_probe.c index eb260eceb4d2..fafb2b84fa5c 100644 --- a/drivers/xen/xenbus/xenbus_probe.c +++ b/drivers/xen/xenbus/xenbus_probe.c @@ -514,7 +514,7 @@ int xenbus_probe_node(struct xen_bus_type *bus, char devname[XEN_BUS_ID_SIZE]; int err; struct xenbus_device *xendev; - size_t stringlen; + size_t name_len, type_len; char *tmpstring; enum xenbus_state state = xenbus_read_driver_state(NULL, nodename); @@ -525,8 +525,9 @@ int xenbus_probe_node(struct xen_bus_type *bus, return 0; } - stringlen = strlen(nodename) + 1 + strlen(type) + 1; - xendev = kzalloc(sizeof(*xendev) + stringlen, GFP_KERNEL); + name_len = strlen(nodename); + type_len = strlen(type); + xendev = kzalloc(sizeof(*xendev) + name_len + 1 + type_len + 1, GFP_KERNEL); if (!xendev) return -ENOMEM; @@ -535,11 +536,11 @@ int xenbus_probe_node(struct xen_bus_type *bus, /* Copy the strings into the extra space. */ tmpstring = (char *)(xendev + 1); - strcpy(tmpstring, nodename); + memcpy(tmpstring, nodename, name_len); xendev->nodename = tmpstring; - tmpstring += strlen(tmpstring) + 1; - strcpy(tmpstring, type); + tmpstring += name_len + 1; + memcpy(tmpstring, type, type_len); xendev->devicetype = tmpstring; init_completion(&xendev->down);