linux-kernel - Re: [PATCH 1/5] drivers/net/ethernet/intel-ice: ensure the copied buf is NULL terminated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Tue, 23 Apr 2024 11:20:02 +0200
From: Przemek Kitszel <przemyslaw.kitszel@...el.com>
To: Bui Quang Minh <minhquangbui99@...il.com>, Jesse Brandeburg
	<jesse.brandeburg@...el.com>, Tony Nguyen <anthony.l.nguyen@...el.com>,
	"David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, "Paul M
 Stillwell Jr" <paul.m.stillwell.jr@...el.com>, Rasesh Mody
	<rmody@...vell.com>, Sudarsana Kalluru <skalluru@...vell.com>,
	<GR-Linux-NIC-Dev@...vell.com>, Krishna Gudipati <kgudipat@...cade.com>,
	"Anil Gurumurthy" <anil.gurumurthy@...gic.com>, Sudarsana Kalluru
	<sudarsana.kalluru@...gic.com>, "James E.J. Bottomley"
	<James.Bottomley@...senPartnership.com>, "Martin K. Petersen"
	<martin.petersen@...cle.com>, Fabian Frederick <fabf@...net.be>, "Saurav
 Kashyap" <skashyap@...vell.com>, Javed Hasan <jhasan@...vell.com>,
	<GR-QLogic-Storage-Upstream@...vell.com>, Nilesh Javali
	<nilesh.javali@...ium.com>, Arun Easi <arun.easi@...ium.com>, "Manish
 Rangankar" <manish.rangankar@...ium.com>, Vineeth Vijayan
	<vneethv@...ux.ibm.com>, Peter Oberparleiter <oberpar@...ux.ibm.com>, "Heiko
 Carstens" <hca@...ux.ibm.com>, Vasily Gorbik <gor@...ux.ibm.com>, "Alexander
 Gordeev" <agordeev@...ux.ibm.com>, Christian Borntraeger
	<borntraeger@...ux.ibm.com>, Sven Schnelle <svens@...ux.ibm.com>
CC: <intel-wired-lan@...ts.osuosl.org>, <netdev@...r.kernel.org>,
	<linux-kernel@...r.kernel.org>, <linux-scsi@...r.kernel.org>, Saurav Kashyap
	<saurav.kashyap@...ium.com>, <linux-s390@...r.kernel.org>, Jens Axboe
	<axboe@...nel.dk>, "Czapnik, Lukasz" <lukasz.czapnik@...el.com>
Subject: Re: [PATCH 1/5] drivers/net/ethernet/intel-ice: ensure the copied buf
 is NULL terminated

On 4/22/24 18:41, Bui Quang Minh wrote:
> Currently, we allocate a count-sized kernel buffer and copy count bytes
> from userspace to that buffer. Later, we use sscanf on this buffer but we
> don't ensure that the string is terminated inside the buffer, this can lead
> to OOB read when using sscanf. Fix this issue by using memdup_user_nul
> instead of memdup_user.
> 
> Fixes: 96a9a9341cda ("ice: configure FW logging")
> Fixes: 73671c3162c8 ("ice: enable FW logging")
> Signed-off-by: Bui Quang Minh <minhquangbui99@...il.com>
> ---
>   drivers/net/ethernet/intel/ice/ice_debugfs.c | 8 ++++----
>   1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_debugfs.c b/drivers/net/ethernet/intel/ice/ice_debugfs.c
> index d252d98218d0..9fc0fd95a13d 100644
> --- a/drivers/net/ethernet/intel/ice/ice_debugfs.c
> +++ b/drivers/net/ethernet/intel/ice/ice_debugfs.c
> @@ -171,7 +171,7 @@ ice_debugfs_module_write(struct file *filp, const char __user *buf,
>   	if (*ppos != 0 || count > 8)
>   		return -EINVAL;
>   
> -	cmd_buf = memdup_user(buf, count);
> +	cmd_buf = memdup_user_nul(buf, count);
>   	if (IS_ERR(cmd_buf))
>   		return PTR_ERR(cmd_buf);
>   
> @@ -257,7 +257,7 @@ ice_debugfs_nr_messages_write(struct file *filp, const char __user *buf,
>   	if (*ppos != 0 || count > 4)
>   		return -EINVAL;
>   
> -	cmd_buf = memdup_user(buf, count);
> +	cmd_buf = memdup_user_nul(buf, count);
>   	if (IS_ERR(cmd_buf))
>   		return PTR_ERR(cmd_buf);
>   
> @@ -332,7 +332,7 @@ ice_debugfs_enable_write(struct file *filp, const char __user *buf,
>   	if (*ppos != 0 || count > 2)
>   		return -EINVAL;
>   
> -	cmd_buf = memdup_user(buf, count);
> +	cmd_buf = memdup_user_nul(buf, count);
>   	if (IS_ERR(cmd_buf))
>   		return PTR_ERR(cmd_buf);
>   
> @@ -428,7 +428,7 @@ ice_debugfs_log_size_write(struct file *filp, const char __user *buf,
>   	if (*ppos != 0 || count > 5)
>   		return -EINVAL;
>   
> -	cmd_buf = memdup_user(buf, count);
> +	cmd_buf = memdup_user_nul(buf, count);
>   	if (IS_ERR(cmd_buf))
>   		return PTR_ERR(cmd_buf);
>   
> 

Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@...el.com>