linux-kernel - Re: [PATCH v2 3/6] bfa: ensure the copied buf is NUL terminated

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <yq15xvqzadt.fsf@ca-mkp.ca.oracle.com>
Date: Mon, 06 May 2024 21:19:52 -0400
From: "Martin K. Petersen" <martin.petersen@...cle.com>
To: Bui Quang Minh <minhquangbui99@...il.com>
Cc: Jesse Brandeburg <jesse.brandeburg@...el.com>,
        Tony Nguyen
 <anthony.l.nguyen@...el.com>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>,
        Paul M Stillwell Jr
 <paul.m.stillwell.jr@...el.com>,
        Rasesh Mody <rmody@...vell.com>,
        Sudarsana Kalluru <skalluru@...vell.com>, GR-Linux-NIC-Dev@...vell.com,
        Anil Gurumurthy <anil.gurumurthy@...gic.com>,
        Sudarsana Kalluru
 <sudarsana.kalluru@...gic.com>,
        "James E.J. Bottomley"
 <James.Bottomley@...senPartnership.com>,
        "Martin K. Petersen"
 <martin.petersen@...cle.com>,
        Fabian Frederick <fabf@...net.be>,
        Saurav
 Kashyap <skashyap@...vell.com>,
        GR-QLogic-Storage-Upstream@...vell.com,
        Nilesh Javali <nilesh.javali@...ium.com>,
        Arun Easi
 <arun.easi@...ium.com>,
        Manish Rangankar <manish.rangankar@...ium.com>,
        Vineeth Vijayan <vneethv@...ux.ibm.com>,
        Peter Oberparleiter
 <oberpar@...ux.ibm.com>,
        Heiko Carstens <hca@...ux.ibm.com>, Vasily
 Gorbik <gor@...ux.ibm.com>,
        Alexander Gordeev <agordeev@...ux.ibm.com>,
        Christian Borntraeger <borntraeger@...ux.ibm.com>,
        Sven Schnelle
 <svens@...ux.ibm.com>,
        Sunil Goutham <sgoutham@...vell.com>,
        Linu
 Cherian <lcherian@...vell.com>,
        Geetha sowjanya <gakula@...vell.com>, Jerin Jacob <jerinj@...vell.com>,
        hariprasad <hkelam@...vell.com>,
        Subbaraya Sundeep <sbhatta@...vell.com>,
        intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
        linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org,
        Saurav
 Kashyap <saurav.kashyap@...ium.com>,
        linux-s390@...r.kernel.org, Jens
 Axboe <axboe@...nel.dk>
Subject: Re: [PATCH v2 3/6] bfa: ensure the copied buf is NUL terminated


Bui,

> Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from
> userspace to that buffer. Later, we use sscanf on this buffer but we don't
> ensure that the string is terminated inside the buffer, this can lead to
> OOB read when using sscanf. Fix this issue by using memdup_user_nul
> instead of memdup_user.

Applied to 6.10/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering