linux-kernel - Re: [PATCH next] RDMA/bnxt_re: Fix buffer overflow in debugfs code

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CA+sbYW1L=RDfw2pgte5Ut6kHqrN_v1_h395+PYYroOpRM6Z3zg@mail.gmail.com>
Date: Sat, 8 Feb 2025 18:49:53 +0530
From: Selvin Xavier <selvin.xavier@...adcom.com>
To: Dan Carpenter <dan.carpenter@...aro.org>
Cc: Kalesh AP <kalesh-anakkur.purayil@...adcom.com>, Jason Gunthorpe <jgg@...pe.ca>, 
	Leon Romanovsky <leon@...nel.org>, linux-rdma@...r.kernel.org, linux-kernel@...r.kernel.org, 
	kernel-janitors@...r.kernel.org
Subject: Re: [PATCH next] RDMA/bnxt_re: Fix buffer overflow in debugfs code

On Fri, Feb 7, 2025 at 2:46 PM Dan Carpenter <dan.carpenter@...aro.org> wrote:
>
> Add some bounds checking to prevent memory corruption in
> bnxt_re_cc_config_set().  This is debugfs code so the bug can only be
> triggered by root.
>
> Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook")
> Signed-off-by: Dan Carpenter <dan.carpenter@...aro.org>
Acked-by: Selvin Xavier <selvin.xavier@...adcom.com>

Thanks,
Selvin
> ---
>  drivers/infiniband/hw/bnxt_re/debugfs.c | 3 +++
>  1 file changed, 3 insertions(+)
>
> diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c
> index f4dd2fb51867..d7354e7753fe 100644
> --- a/drivers/infiniband/hw/bnxt_re/debugfs.c
> +++ b/drivers/infiniband/hw/bnxt_re/debugfs.c
> @@ -285,6 +285,9 @@ static ssize_t bnxt_re_cc_config_set(struct file *filp, const char __user *buffe
>         u32 val;
>         int rc;
>
> +       if (count >= sizeof(buf))
> +               return -EINVAL;
> +
>         if (copy_from_user(buf, buffer, count))
>                 return -EFAULT;
>
> --
> 2.47.2
>

Download attachment "smime.p7s" of type "application/pkcs7-signature" (4224 bytes)