Skip to content
Snippets Groups Projects
Commit 666854ea authored by Bui Quang Minh's avatar Bui Quang Minh Committed by Jakub Kicinski
Browse files

ice: ensure the copied buf is NUL terminated


Currently, we allocate a count-sized kernel buffer and copy count bytes
from userspace to that buffer. Later, we use sscanf on this buffer but we
don't ensure that the string is terminated inside the buffer, this can lead
to OOB read when using sscanf. Fix this issue by using memdup_user_nul
instead of memdup_user.

Fixes: 96a9a934 ("ice: configure FW logging")
Fixes: 73671c31 ("ice: enable FW logging")
Reviewed-by: default avatarPrzemek Kitszel <przemyslaw.kitszel@intel.com>
Signed-off-by: default avatarBui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-1-f1f1b53a10f4@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 52afb15e
No related branches found
No related tags found
No related merge requests found
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment