From: Dan Carpenter Date: Fri, 7 Mar 2025 09:28:48 +0000 (+0300) Subject: eth: fbnic: fix memory corruption in fbnic_tlv_attr_get_string() X-Git-Tag: v6.15-rc1~160^2~126 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=991a1b09920bc15c66f64c1e7d15cdabd3816c46;p=thirdparty%2Fkernel%2Flinux.git eth: fbnic: fix memory corruption in fbnic_tlv_attr_get_string() This code is trying to ensure that the last byte of the buffer is a NUL terminator. However, the problem is that attr->value[] is an array of __le32, not char, so it zeroes out 4 bytes way beyond the end of the buffer. Cast the buffer to char to address this. Fixes: e5cf5107c9e4 ("eth: fbnic: Update fbnic_tlv_attr_get_string() to work like nla_strscpy()") Signed-off-by: Dan Carpenter Reviewed-by: Lee Trager Link: https://patch.msgid.link/2791d4be-ade4-4e50-9b12-33307d8410f6@stanley.mountain Signed-off-by: Jakub Kicinski --- diff --git a/drivers/net/ethernet/meta/fbnic/fbnic_tlv.c b/drivers/net/ethernet/meta/fbnic/fbnic_tlv.c index d558d176e0dfc..517ed8b2f1cb7 100644 --- a/drivers/net/ethernet/meta/fbnic/fbnic_tlv.c +++ b/drivers/net/ethernet/meta/fbnic/fbnic_tlv.c @@ -261,7 +261,7 @@ ssize_t fbnic_tlv_attr_get_string(struct fbnic_tlv_msg *attr, char *dst, return -E2BIG; srclen = le16_to_cpu(attr->hdr.len) - sizeof(*attr); - if (srclen > 0 && attr->value[srclen - 1] == '\0') + if (srclen > 0 && ((char *)attr->value)[srclen - 1] == '\0') srclen--; if (srclen >= dstsize) {