Patch "selftests/resctrl: Protect against array overflow when reading strings" has been added to the 6.6-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    selftests/resctrl: Protect against array overflow when reading strings

to the 6.6-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     selftests-resctrl-protect-against-array-overflow-whe.patch
and it can be found in the queue-6.6 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit b77915965f1375558b99cedd2deaebc1ad1edff0
Author: Reinette Chatre <reinette.chatre@xxxxxxxxx>
Date:   Thu Oct 24 14:18:42 2024 -0700

    selftests/resctrl: Protect against array overflow when reading strings
    
    [ Upstream commit 46058430fc5d39c114f7e1b9c6ff14c9f41bd531 ]
    
    resctrl selftests discover system properties via a variety of sysfs files.
    The MBM and MBA tests need to discover the event and umask with which to
    configure the performance event used to measure read memory bandwidth.
    This is done by parsing the contents of
    /sys/bus/event_source/devices/uncore_imc_<imc instance>/events/cas_count_read
    Similarly, the resctrl selftests discover the cache size via
    /sys/bus/cpu/devices/cpu<id>/cache/index<index>/size.
    
    Take care to do bounds checking when using fscanf() to read the
    contents of files into a string buffer because by default fscanf() assumes
    arbitrarily long strings. If the file contains more bytes than the array
    can accommodate then an overflow will occur.
    
    Provide a maximum field width to the conversion specifier to protect
    against array overflow. The maximum is one less than the array size because
    string input stores a terminating null byte that is not covered by the
    maximum field width.
    
    Signed-off-by: Reinette Chatre <reinette.chatre@xxxxxxxxx>
    Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@xxxxxxxxxxxxxxx>
    Signed-off-by: Shuah Khan <skhan@xxxxxxxxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/tools/testing/selftests/resctrl/resctrl_val.c b/tools/testing/selftests/resctrl/resctrl_val.c
index d77fdf356e98e..710058eb25407 100644
--- a/tools/testing/selftests/resctrl/resctrl_val.c
+++ b/tools/testing/selftests/resctrl/resctrl_val.c
@@ -178,7 +178,7 @@ static int read_from_imc_dir(char *imc_dir, int count)
 
 		return -1;
 	}
-	if (fscanf(fp, "%s", cas_count_cfg) <= 0) {
+	if (fscanf(fp, "%1023s", cas_count_cfg) <= 0) {
 		ksft_perror("Could not get iMC cas count read");
 		fclose(fp);
 
@@ -196,7 +196,7 @@ static int read_from_imc_dir(char *imc_dir, int count)
 
 		return -1;
 	}
-	if  (fscanf(fp, "%s", cas_count_cfg) <= 0) {
+	if  (fscanf(fp, "%1023s", cas_count_cfg) <= 0) {
 		ksft_perror("Could not get iMC cas count write");
 		fclose(fp);
 
diff --git a/tools/testing/selftests/resctrl/resctrlfs.c b/tools/testing/selftests/resctrl/resctrlfs.c
index 71ad2b335b83f..fe3241799841b 100644
--- a/tools/testing/selftests/resctrl/resctrlfs.c
+++ b/tools/testing/selftests/resctrl/resctrlfs.c
@@ -160,7 +160,7 @@ int get_cache_size(int cpu_no, char *cache_type, unsigned long *cache_size)
 
 		return -1;
 	}
-	if (fscanf(fp, "%s", cache_str) <= 0) {
+	if (fscanf(fp, "%63s", cache_str) <= 0) {
 		ksft_perror("Could not get cache_size");
 		fclose(fp);