]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
octeontx2-af: avoid off-by-one read from userspace
authorBui Quang Minh <minhquangbui99@gmail.com>
Wed, 24 Apr 2024 14:44:23 +0000 (21:44 +0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 May 2024 10:14:28 +0000 (12:14 +0200)
commitfc3e0076c1f82fe981d321e3a7bad4cbee542c19
tree3a4d6681961033256a2d3b797ccd323e1117c322
parent1518b2b498a0109eb6b15755169d3b6607356b35
octeontx2-af: avoid off-by-one read from userspace

[ Upstream commit f299ee709fb45036454ca11e90cb2810fe771878 ]

We try to access count + 1 byte from userspace with memdup_user(buffer,
count + 1). However, the userspace only provides buffer of count bytes and
only these count bytes are verified to be okay to access. To ensure the
copied buffer is NUL terminated, we use memdup_user_nul instead.

Fixes: 3a2eb515d136 ("octeontx2-af: Fix an off by one in rvu_dbg_qsize_write()")
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-6-f1f1b53a10f4@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c