Re: [PATCH 1/5] drivers/net/ethernet/intel-ice: ensure the copied buf is NULL terminated

[Przemek Kitszel <przemyslaw.kitszel@intel.com>]

On 4/22/24 18:41, Bui Quang Minh wrote:
> Currently, we allocate a count-sized kernel buffer and copy count bytes
> from userspace to that buffer. Later, we use sscanf on this buffer but we
> don't ensure that the string is terminated inside the buffer, this can lead
> to OOB read when using sscanf. Fix this issue by using memdup_user_nul
> instead of memdup_user.
> 
> Fixes: 96a9a9341cda ("ice: configure FW logging")
> Fixes: 73671c3162c8 ("ice: enable FW logging")
> Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
> ---
>   drivers/net/ethernet/intel/ice/ice_debugfs.c | 8 ++++----
>   1 file changed, 4 insertions(+), 4 deletions(-)
> 
> diff --git a/drivers/net/ethernet/intel/ice/ice_debugfs.c b/drivers/net/ethernet/intel/ice/ice_debugfs.c
> index d252d98218d0..9fc0fd95a13d 100644
> --- a/drivers/net/ethernet/intel/ice/ice_debugfs.c
> +++ b/drivers/net/ethernet/intel/ice/ice_debugfs.c
> @@ -171,7 +171,7 @@ ice_debugfs_module_write(struct file *filp, const char __user *buf,
>   	if (*ppos != 0 || count > 8)
>   		return -EINVAL;
>   
> -	cmd_buf = memdup_user(buf, count);
> +	cmd_buf = memdup_user_nul(buf, count);
>   	if (IS_ERR(cmd_buf))
>   		return PTR_ERR(cmd_buf);
>   
> @@ -257,7 +257,7 @@ ice_debugfs_nr_messages_write(struct file *filp, const char __user *buf,
>   	if (*ppos != 0 || count > 4)
>   		return -EINVAL;
>   
> -	cmd_buf = memdup_user(buf, count);
> +	cmd_buf = memdup_user_nul(buf, count);
>   	if (IS_ERR(cmd_buf))
>   		return PTR_ERR(cmd_buf);
>   
> @@ -332,7 +332,7 @@ ice_debugfs_enable_write(struct file *filp, const char __user *buf,
>   	if (*ppos != 0 || count > 2)
>   		return -EINVAL;
>   
> -	cmd_buf = memdup_user(buf, count);
> +	cmd_buf = memdup_user_nul(buf, count);
>   	if (IS_ERR(cmd_buf))
>   		return PTR_ERR(cmd_buf);
>   
> @@ -428,7 +428,7 @@ ice_debugfs_log_size_write(struct file *filp, const char __user *buf,
>   	if (*ppos != 0 || count > 5)
>   		return -EINVAL;
>   
> -	cmd_buf = memdup_user(buf, count);
> +	cmd_buf = memdup_user_nul(buf, count);
>   	if (IS_ERR(cmd_buf))
>   		return PTR_ERR(cmd_buf);
>   
> 

Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@intel.com>