]> www.infradead.org Git - users/jedix/linux-maple.git/commit
scsi: qedf: Ensure the copied buf is NUL terminated
authorBui Quang Minh <minhquangbui99@gmail.com>
Wed, 24 Apr 2024 14:44:21 +0000 (21:44 +0700)
committerMartin K. Petersen <martin.petersen@oracle.com>
Tue, 7 May 2024 01:19:24 +0000 (21:19 -0400)
commitd0184a375ee797eb657d74861ba0935b6e405c62
treefcaf6fc1cce2aae97c801dc9389aca872c4819f9
parent13d0cecb4626fae67c00c84d3c7851f6b62f7df3
scsi: qedf: Ensure the copied buf is NUL terminated

Currently, we allocate a count-sized kernel buffer and copy count from
userspace to that buffer. Later, we use kstrtouint on this buffer but we
don't ensure that the string is terminated inside the buffer, this can
lead to OOB read when using kstrtouint. Fix this issue by using
memdup_user_nul instead of memdup_user.

Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-4-f1f1b53a10f4@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
drivers/scsi/qedf/qedf_debugfs.c