[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <0e60057f-b242-4bb5-b3df-2c6d1ff39803@intel.com>
Date: Tue, 23 Apr 2024 11:20:02 +0200
From: Przemek Kitszel <przemyslaw.kitszel@...el.com>
To: Bui Quang Minh <minhquangbui99@...il.com>, Jesse Brandeburg
<jesse.brandeburg@...el.com>, Tony Nguyen <anthony.l.nguyen@...el.com>,
"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Paul M
Stillwell Jr" <paul.m.stillwell.jr@...el.com>, Rasesh Mody
<rmody@...vell.com>, Sudarsana Kalluru <skalluru@...vell.com>,
<GR-Linux-NIC-Dev@...vell.com>, Krishna Gudipati <kgudipat@...cade.com>,
"Anil Gurumurthy" <anil.gurumurthy@...gic.com>, Sudarsana Kalluru
<sudarsana.kalluru@...gic.com>, "James E.J. Bottomley"
<James.Bottomley@...senPartnership.com>, "Martin K. Petersen"
<martin.petersen@...cle.com>, Fabian Frederick <fabf@...net.be>, "Saurav
Kashyap" <skashyap@...vell.com>, Javed Hasan <jhasan@...vell.com>,
<GR-QLogic-Storage-Upstream@...vell.com>, Nilesh Javali
<nilesh.javali@...ium.com>, Arun Easi <arun.easi@...ium.com>, "Manish
Rangankar" <manish.rangankar@...ium.com>, Vineeth Vijayan
<vneethv@...ux.ibm.com>, Peter Oberparleiter <oberpar@...ux.ibm.com>, "Heiko
Carstens" <hca@...ux.ibm.com>, Vasily Gorbik <gor@...ux.ibm.com>, "Alexander
Gordeev" <agordeev@...ux.ibm.com>, Christian Borntraeger
<borntraeger@...ux.ibm.com>, Sven Schnelle <svens@...ux.ibm.com>
CC: <intel-wired-lan@...ts.osuosl.org>, <netdev@...r.kernel.org>,
<linux-kernel@...r.kernel.org>, <linux-scsi@...r.kernel.org>, Saurav Kashyap
<saurav.kashyap@...ium.com>, <linux-s390@...r.kernel.org>, Jens Axboe
<axboe@...nel.dk>, "Czapnik, Lukasz" <lukasz.czapnik@...el.com>
Subject: Re: [PATCH 1/5] drivers/net/ethernet/intel-ice: ensure the copied buf
is NULL terminated
On 4/22/24 18:41, Bui Quang Minh wrote:
> Currently, we allocate a count-sized kernel buffer and copy count bytes
> from userspace to that buffer. Later, we use sscanf on this buffer but we
> don't ensure that the string is terminated inside the buffer, this can lead
> to OOB read when using sscanf. Fix this issue by using memdup_user_nul
> instead of memdup_user.
>
> Fixes: 96a9a9341cda ("ice: configure FW logging")
> Fixes: 73671c3162c8 ("ice: enable FW logging")
> Signed-off-by: Bui Quang Minh <minhquangbui99@...il.com>
> ---
> drivers/net/ethernet/intel/ice/ice_debugfs.c | 8 ++++----
> 1 file changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice_debugfs.c b/drivers/net/ethernet/intel/ice/ice_debugfs.c
> index d252d98218d0..9fc0fd95a13d 100644
> --- a/drivers/net/ethernet/intel/ice/ice_debugfs.c
> +++ b/drivers/net/ethernet/intel/ice/ice_debugfs.c
> @@ -171,7 +171,7 @@ ice_debugfs_module_write(struct file *filp, const char __user *buf,
> if (*ppos != 0 || count > 8)
> return -EINVAL;
>
> - cmd_buf = memdup_user(buf, count);
> + cmd_buf = memdup_user_nul(buf, count);
> if (IS_ERR(cmd_buf))
> return PTR_ERR(cmd_buf);
>
> @@ -257,7 +257,7 @@ ice_debugfs_nr_messages_write(struct file *filp, const char __user *buf,
> if (*ppos != 0 || count > 4)
> return -EINVAL;
>
> - cmd_buf = memdup_user(buf, count);
> + cmd_buf = memdup_user_nul(buf, count);
> if (IS_ERR(cmd_buf))
> return PTR_ERR(cmd_buf);
>
> @@ -332,7 +332,7 @@ ice_debugfs_enable_write(struct file *filp, const char __user *buf,
> if (*ppos != 0 || count > 2)
> return -EINVAL;
>
> - cmd_buf = memdup_user(buf, count);
> + cmd_buf = memdup_user_nul(buf, count);
> if (IS_ERR(cmd_buf))
> return PTR_ERR(cmd_buf);
>
> @@ -428,7 +428,7 @@ ice_debugfs_log_size_write(struct file *filp, const char __user *buf,
> if (*ppos != 0 || count > 5)
> return -EINVAL;
>
> - cmd_buf = memdup_user(buf, count);
> + cmd_buf = memdup_user_nul(buf, count);
> if (IS_ERR(cmd_buf))
> return PTR_ERR(cmd_buf);
>
>
Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@...el.com>
Powered by blists - more mailing lists