netdev - [PATCH v2 6/6] octeontx2-af: avoid off-by-one read from userspace

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20240424-fix-oob-read-v2-6-f1f1b53a10f4@gmail.com>
Date: Wed, 24 Apr 2024 21:44:23 +0700
From: Bui Quang Minh <minhquangbui99@...il.com>
To: Jesse Brandeburg <jesse.brandeburg@...el.com>, 
 Tony Nguyen <anthony.l.nguyen@...el.com>, 
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>, 
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>, 
 Paul M Stillwell Jr <paul.m.stillwell.jr@...el.com>, 
 Rasesh Mody <rmody@...vell.com>, Sudarsana Kalluru <skalluru@...vell.com>, 
 GR-Linux-NIC-Dev@...vell.com, Anil Gurumurthy <anil.gurumurthy@...gic.com>, 
 Sudarsana Kalluru <sudarsana.kalluru@...gic.com>, 
 "James E.J. Bottomley" <James.Bottomley@...senPartnership.com>, 
 "Martin K. Petersen" <martin.petersen@...cle.com>, 
 Fabian Frederick <fabf@...net.be>, Saurav Kashyap <skashyap@...vell.com>, 
 GR-QLogic-Storage-Upstream@...vell.com, 
 Nilesh Javali <nilesh.javali@...ium.com>, Arun Easi <arun.easi@...ium.com>, 
 Manish Rangankar <manish.rangankar@...ium.com>, 
 Vineeth Vijayan <vneethv@...ux.ibm.com>, 
 Peter Oberparleiter <oberpar@...ux.ibm.com>, 
 Heiko Carstens <hca@...ux.ibm.com>, Vasily Gorbik <gor@...ux.ibm.com>, 
 Alexander Gordeev <agordeev@...ux.ibm.com>, 
 Christian Borntraeger <borntraeger@...ux.ibm.com>, 
 Sven Schnelle <svens@...ux.ibm.com>, Sunil Goutham <sgoutham@...vell.com>, 
 Linu Cherian <lcherian@...vell.com>, Geetha sowjanya <gakula@...vell.com>, 
 Jerin Jacob <jerinj@...vell.com>, hariprasad <hkelam@...vell.com>, 
 Subbaraya Sundeep <sbhatta@...vell.com>
Cc: intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org, 
 linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org, 
 Saurav Kashyap <saurav.kashyap@...ium.com>, linux-s390@...r.kernel.org, 
 Jens Axboe <axboe@...nel.dk>, Bui Quang Minh <minhquangbui99@...il.com>
Subject: [PATCH v2 6/6] octeontx2-af: avoid off-by-one read from userspace

We try to access count + 1 byte from userspace with memdup_user(buffer,
count + 1). However, the userspace only provides buffer of count bytes and
only these count bytes are verified to be okay to access. To ensure the
copied buffer is NUL terminated, we use memdup_user_nul instead.

Fixes: 3a2eb515d136 ("octeontx2-af: Fix an off by one in rvu_dbg_qsize_write()")
Signed-off-by: Bui Quang Minh <minhquangbui99@...il.com>
---
 drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c | 4 +---
 1 file changed, 1 insertion(+), 3 deletions(-)

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
index 2500f5ba4f5a..881d704644fb 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -999,12 +999,10 @@ static ssize_t rvu_dbg_qsize_write(struct file *filp,
 	u16 pcifunc;
 	int ret, lf;

-	cmd_buf = memdup_user(buffer, count + 1);
+	cmd_buf = memdup_user_nul(buffer, count);
 	if (IS_ERR(cmd_buf))
 		return -ENOMEM;

-	cmd_buf[count] = '\0';
-
 	cmd_buf_tmp = strchr(cmd_buf, '\n');
 	if (cmd_buf_tmp) {
 		*cmd_buf_tmp = '\0';

-- 
2.34.1