Skip to content

Commit

Permalink
scsi: qedf: Ensure the copied buf is NUL terminated
Browse files Browse the repository at this point in the history
Currently, we allocate a count-sized kernel buffer and copy count from
userspace to that buffer. Later, we use kstrtouint on this buffer but we
don't ensure that the string is terminated inside the buffer, this can
lead to OOB read when using kstrtouint. Fix this issue by using
memdup_user_nul instead of memdup_user.

Fixes: 61d8658 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-4-f1f1b53a10f4@gmail.com
Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
  • Loading branch information
minhbq-99 authored and martinkpetersen committed May 7, 2024
1 parent 13d0cec commit d0184a3
Showing 1 changed file with 1 addition and 1 deletion.
2 changes: 1 addition & 1 deletion drivers/scsi/qedf/qedf_debugfs.c
Original file line number Diff line number Diff line change
Expand Up @@ -170,7 +170,7 @@ qedf_dbg_debug_cmd_write(struct file *filp, const char __user *buffer,
if (!count || *ppos)
return 0;

kern_buf = memdup_user(buffer, count);
kern_buf = memdup_user_nul(buffer, count);
if (IS_ERR(kern_buf))
return PTR_ERR(kern_buf);

Expand Down

0 comments on commit d0184a3

Please sign in to comment.