Re: [PATCH] orangefs: fix a oob in orangefs_debug_write

[Al Viro <viro@zeniv.linux.org.uk>]

On Sun, Dec 22, 2024 at 04:14:13PM +0800, Edward Adam Davis wrote:
> syzbot report a slab-out-of-bounds Read in orangefs_debug_write. [1]
> 
> The string passed in from userspace is not terminated with a NULL character,
> which causes strlen to go out of bounds.
> 
> Use kstrndup to replace kstrdup.

Better to replace
        if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) {
		silly = count;
		count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1;
	}
with
        if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) {
		silly = count;
		count = ORANGEFS_MAX_DEBUG_STRING_LEN;
	}
instead, so that we wouldn't have to deal with lack of NUL anywhere.