linux-kernel - Re: [PATCH v2 5/6] cio: ensure the copied buf is NUL terminated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240424145405.26193-C-hca@linux.ibm.com>
Date: Wed, 24 Apr 2024 16:54:05 +0200
From: Heiko Carstens <hca@...ux.ibm.com>
To: Bui Quang Minh <minhquangbui99@...il.com>
Cc: Jesse Brandeburg <jesse.brandeburg@...el.com>,
        Tony Nguyen <anthony.l.nguyen@...el.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Paul M Stillwell Jr <paul.m.stillwell.jr@...el.com>,
        Rasesh Mody <rmody@...vell.com>,
        Sudarsana Kalluru <skalluru@...vell.com>, GR-Linux-NIC-Dev@...vell.com,
        Anil Gurumurthy <anil.gurumurthy@...gic.com>,
        Sudarsana Kalluru <sudarsana.kalluru@...gic.com>,
        "James E.J. Bottomley" <James.Bottomley@...senpartnership.com>,
        "Martin K. Petersen" <martin.petersen@...cle.com>,
        Fabian Frederick <fabf@...net.be>,
        Saurav Kashyap <skashyap@...vell.com>,
        GR-QLogic-Storage-Upstream@...vell.com,
        Nilesh Javali <nilesh.javali@...ium.com>,
        Arun Easi <arun.easi@...ium.com>,
        Manish Rangankar <manish.rangankar@...ium.com>,
        Vineeth Vijayan <vneethv@...ux.ibm.com>,
        Peter Oberparleiter <oberpar@...ux.ibm.com>,
        Vasily Gorbik <gor@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Sven Schnelle <svens@...ux.ibm.com>,
        Sunil Goutham <sgoutham@...vell.com>,
        Linu Cherian <lcherian@...vell.com>,
        Geetha sowjanya <gakula@...vell.com>, Jerin Jacob <jerinj@...vell.com>,
        hariprasad <hkelam@...vell.com>,
        Subbaraya Sundeep <sbhatta@...vell.com>,
        intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org,
        Saurav Kashyap <saurav.kashyap@...ium.com>, linux-s390@...r.kernel.org,
        Jens Axboe <axboe@...nel.dk>
Subject: Re: [PATCH v2 5/6] cio: ensure the copied buf is NUL terminated

On Wed, Apr 24, 2024 at 09:44:22PM +0700, Bui Quang Minh wrote:
> Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from
> userspace to that buffer. Later, we use scanf on this buffer but we don't
> ensure that the string is terminated inside the buffer, this can lead to
> OOB read when using scanf. Fix this issue by using memdup_user_nul instead.
> 
> Fixes: a4f17cc72671 ("s390/cio: add CRW inject functionality")
> Signed-off-by: Bui Quang Minh <minhquangbui99@...il.com>
> ---
>  drivers/s390/cio/cio_inject.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)

Reviewed-by: Heiko Carstens <hca@...ux.ibm.com>