[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <ZikiZsSTGUUM69GE@li-008a6a4c-3549-11b2-a85c-c5cc2836eea2.ibm.com>
Date: Wed, 24 Apr 2024 17:16:54 +0200
From: Alexander Gordeev <agordeev@...ux.ibm.com>
To: Bui Quang Minh <minhquangbui99@...il.com>
Cc: Jesse Brandeburg <jesse.brandeburg@...el.com>,
Tony Nguyen <anthony.l.nguyen@...el.com>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>, Jakub Kicinski <kuba@...nel.org>,
Paolo Abeni <pabeni@...hat.com>,
Paul M Stillwell Jr <paul.m.stillwell.jr@...el.com>,
Rasesh Mody <rmody@...vell.com>,
Sudarsana Kalluru <skalluru@...vell.com>, GR-Linux-NIC-Dev@...vell.com,
Anil Gurumurthy <anil.gurumurthy@...gic.com>,
Sudarsana Kalluru <sudarsana.kalluru@...gic.com>,
"James E.J. Bottomley" <James.Bottomley@...senpartnership.com>,
"Martin K. Petersen" <martin.petersen@...cle.com>,
Fabian Frederick <fabf@...net.be>,
Saurav Kashyap <skashyap@...vell.com>,
GR-QLogic-Storage-Upstream@...vell.com,
Nilesh Javali <nilesh.javali@...ium.com>,
Arun Easi <arun.easi@...ium.com>,
Manish Rangankar <manish.rangankar@...ium.com>,
Vineeth Vijayan <vneethv@...ux.ibm.com>,
Peter Oberparleiter <oberpar@...ux.ibm.com>,
Heiko Carstens <hca@...ux.ibm.com>, Vasily Gorbik <gor@...ux.ibm.com>,
Christian Borntraeger <borntraeger@...ux.ibm.com>,
Sven Schnelle <svens@...ux.ibm.com>,
Sunil Goutham <sgoutham@...vell.com>,
Linu Cherian <lcherian@...vell.com>,
Geetha sowjanya <gakula@...vell.com>, Jerin Jacob <jerinj@...vell.com>,
hariprasad <hkelam@...vell.com>,
Subbaraya Sundeep <sbhatta@...vell.com>,
intel-wired-lan@...ts.osuosl.org, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, linux-scsi@...r.kernel.org,
Saurav Kashyap <saurav.kashyap@...ium.com>, linux-s390@...r.kernel.org,
Jens Axboe <axboe@...nel.dk>
Subject: Re: [PATCH v2 5/6] cio: ensure the copied buf is NUL terminated
On Wed, Apr 24, 2024 at 09:44:22PM +0700, Bui Quang Minh wrote:
> Currently, we allocate a lbuf-sized kernel buffer and copy lbuf from
> userspace to that buffer. Later, we use scanf on this buffer but we don't
> ensure that the string is terminated inside the buffer, this can lead to
> OOB read when using scanf. Fix this issue by using memdup_user_nul instead.
>
> Fixes: a4f17cc72671 ("s390/cio: add CRW inject functionality")
> Signed-off-by: Bui Quang Minh <minhquangbui99@...il.com>
> ---
> drivers/s390/cio/cio_inject.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
Applied, thanks!
Powered by blists - more mailing lists