Patch "octeontx2-af: avoid off-by-one read from userspace" has been added to the 6.8-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    octeontx2-af: avoid off-by-one read from userspace

to the 6.8-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     octeontx2-af-avoid-off-by-one-read-from-userspace.patch
and it can be found in the queue-6.8 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 6bc5e5812c8403c269325b508250ce44ae55dddf
Author: Bui Quang Minh <minhquangbui99@xxxxxxxxx>
Date:   Wed Apr 24 21:44:23 2024 +0700

    octeontx2-af: avoid off-by-one read from userspace
    
    [ Upstream commit f299ee709fb45036454ca11e90cb2810fe771878 ]
    
    We try to access count + 1 byte from userspace with memdup_user(buffer,
    count + 1). However, the userspace only provides buffer of count bytes and
    only these count bytes are verified to be okay to access. To ensure the
    copied buffer is NUL terminated, we use memdup_user_nul instead.
    
    Fixes: 3a2eb515d136 ("octeontx2-af: Fix an off by one in rvu_dbg_qsize_write()")
    Signed-off-by: Bui Quang Minh <minhquangbui99@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-6-f1f1b53a10f4@xxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
index e6d7914ce61c4..e7eca8141e8c7 100644
--- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
+++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c
@@ -999,12 +999,10 @@ static ssize_t rvu_dbg_qsize_write(struct file *filp,
 	u16 pcifunc;
 	int ret, lf;
 
-	cmd_buf = memdup_user(buffer, count + 1);
+	cmd_buf = memdup_user_nul(buffer, count);
 	if (IS_ERR(cmd_buf))
 		return -ENOMEM;
 
-	cmd_buf[count] = '\0';
-
 	cmd_buf_tmp = strchr(cmd_buf, '\n');
 	if (cmd_buf_tmp) {
 		*cmd_buf_tmp = '\0';




[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux