Skip to content
Commit a5b1051a authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'ensure-the-copied-buf-is-nul-terminated'

Bui Quang Minh says:

====================
Ensure the copied buf is NUL terminated (part)

I found that some drivers contains an out-of-bound read pattern like this

	kern_buf = memdup_user(user_buf, count);
	...
	sscanf(kern_buf, ...);

The sscanf can be replaced by some other string-related functions. This
pattern can lead to out-of-bound read of kern_buf in string-related
functions.

This series fix the above issue by replacing memdup_user with
memdup_user_nul.

v1: https://lore.kernel.org/r/20240422-fix-oob-read-v1-0-e02854c30174@gmail.com
====================

Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-0-f1f1b53a10f4@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 52afb15e f299ee70
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment