Skip to content
Commit f299ee70 authored by Bui Quang Minh's avatar Bui Quang Minh Committed by Jakub Kicinski
Browse files

octeontx2-af: avoid off-by-one read from userspace



We try to access count + 1 byte from userspace with memdup_user(buffer,
count + 1). However, the userspace only provides buffer of count bytes and
only these count bytes are verified to be okay to access. To ensure the
copied buffer is NUL terminated, we use memdup_user_nul instead.

Fixes: 3a2eb515 ("octeontx2-af: Fix an off by one in rvu_dbg_qsize_write()")
Signed-off-by: default avatarBui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-6-f1f1b53a10f4@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 8c34096c
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment