All of lore.kernel.org
 help / color / mirror / Atom feed
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Pengpeng Hou <pengpeng@iscas.ac.cn>
Cc: Richard Weinberger <richard@nod.at>,
	 Vignesh Raghavendra <vigneshr@ti.com>,
	 Kees Cook <kees@kernel.org>,  Finn Thain <fthain@linux-m68k.org>,
	 linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mtd: parsers: redboot: reject unterminated FIS names
Date: Thu, 02 Jul 2026 15:07:53 +0200	[thread overview]
Message-ID: <87ldbtr13q.fsf@bootlin.com> (raw)
In-Reply-To: <20260701053909.53859-1-pengpeng@iscas.ac.cn> (Pengpeng Hou's message of "Wed, 1 Jul 2026 13:39:09 +0800")

Hi Pengpeng,

On 01/07/2026 at 13:39:09 +08, Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:

> RedBoot FIS partition names are stored in a fixed 16-byte field that is
> expected to be NUL-terminated. parse_redboot_partitions() used strlen()
> to size the names area and later copied the same field with strcpy(), so
> a malformed table entry without a terminator could make both operations
> read beyond the descriptor.
>
> Validate each accepted FIS name with strnlen() before adding it to the
> partition list.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

Please add Fixes and Cc stable tags whenever you send a fix. The fixes
look correct and are correctly documented, but all of them miss
the tags.

Thanks,
Miquèl

WARNING: multiple messages have this Message-ID (diff)
From: Miquel Raynal <miquel.raynal@bootlin.com>
To: Pengpeng Hou <pengpeng@iscas.ac.cn>
Cc: Richard Weinberger <richard@nod.at>,
	 Vignesh Raghavendra <vigneshr@ti.com>,
	 Kees Cook <kees@kernel.org>,  Finn Thain <fthain@linux-m68k.org>,
	 linux-mtd@lists.infradead.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH] mtd: parsers: redboot: reject unterminated FIS names
Date: Thu, 02 Jul 2026 15:07:53 +0200	[thread overview]
Message-ID: <87ldbtr13q.fsf@bootlin.com> (raw)
In-Reply-To: <20260701053909.53859-1-pengpeng@iscas.ac.cn> (Pengpeng Hou's message of "Wed, 1 Jul 2026 13:39:09 +0800")

Hi Pengpeng,

On 01/07/2026 at 13:39:09 +08, Pengpeng Hou <pengpeng@iscas.ac.cn> wrote:

> RedBoot FIS partition names are stored in a fixed 16-byte field that is
> expected to be NUL-terminated. parse_redboot_partitions() used strlen()
> to size the names area and later copied the same field with strcpy(), so
> a malformed table entry without a terminator could make both operations
> read beyond the descriptor.
>
> Validate each accepted FIS name with strnlen() before adding it to the
> partition list.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>

Please add Fixes and Cc stable tags whenever you send a fix. The fixes
look correct and are correctly documented, but all of them miss
the tags.

Thanks,
Miquèl

______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/

  reply	other threads:[~2026-07-02 13:07 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-07-01  5:39 [PATCH] mtd: parsers: redboot: reject unterminated FIS names Pengpeng Hou
2026-07-01  5:39 ` Pengpeng Hou
2026-07-02 13:07 ` Miquel Raynal [this message]
2026-07-02 13:07   ` Miquel Raynal
2026-07-03 13:49 ` Miquel Raynal
2026-07-03 13:49   ` Miquel Raynal

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=87ldbtr13q.fsf@bootlin.com \
    --to=miquel.raynal@bootlin.com \
    --cc=fthain@linux-m68k.org \
    --cc=kees@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=linux-mtd@lists.infradead.org \
    --cc=pengpeng@iscas.ac.cn \
    --cc=richard@nod.at \
    --cc=vigneshr@ti.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.