Fixes for 6.6

[thirdparty/kernel/stable-queue.git] / queue-6.6 / bna-ensure-the-copied-buf-is-nul-terminated.patch

diff --git a/queue-6.6/bna-ensure-the-copied-buf-is-nul-terminated.patch b/queue-6.6/bna-ensure-the-copied-buf-is-nul-terminated.patch
new file mode 100644 (file)
index 0000000..08bebe0
--- /dev/null
+++ b/queue-6.6/bna-ensure-the-copied-buf-is-nul-terminated.patch
@@ -0,0 +1,49 @@
+From ba5d3bb06c0a5e14e62cc3cc7fd556d7f8156cca Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Wed, 24 Apr 2024 21:44:19 +0700
+Subject: bna: ensure the copied buf is NUL terminated
+
+From: Bui Quang Minh <minhquangbui99@gmail.com>
+
+[ Upstream commit 8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f ]
+
+Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from
+userspace to that buffer. Later, we use sscanf on this buffer but we don't
+ensure that the string is terminated inside the buffer, this can lead to
+OOB read when using sscanf. Fix this issue by using memdup_user_nul
+instead of memdup_user.
+
+Fixes: 7afc5dbde091 ("bna: Add debugfs interface.")
+Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
+Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-2-f1f1b53a10f4@gmail.com
+Signed-off-by: Jakub Kicinski <kuba@kernel.org>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ drivers/net/ethernet/brocade/bna/bnad_debugfs.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+index 7246e13dd559f..97291bfbeea58 100644
+--- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
++++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+@@ -312,7 +312,7 @@ bnad_debugfs_write_regrd(struct file *file, const char __user *buf,
+       void *kern_buf;
+ 
+       /* Copy the user space buf */
+-      kern_buf = memdup_user(buf, nbytes);
++      kern_buf = memdup_user_nul(buf, nbytes);
+       if (IS_ERR(kern_buf))
+               return PTR_ERR(kern_buf);
+ 
+@@ -372,7 +372,7 @@ bnad_debugfs_write_regwr(struct file *file, const char __user *buf,
+       void *kern_buf;
+ 
+       /* Copy the user space buf */
+-      kern_buf = memdup_user(buf, nbytes);
++      kern_buf = memdup_user_nul(buf, nbytes);
+       if (IS_ERR(kern_buf))
+               return PTR_ERR(kern_buf);
+ 
+-- 
+2.43.0
+