[PATCH 5.10] scsi: gdth: ensure event string is NUL-terminated

[PATCH 5.10] scsi: gdth: ensure event string is NUL-terminated

[Daniil Iskhakov]

No upstream commit exists for this patch. GDT driver was removed from
kernel in commit 0653c358d2dc ("scsi: Drop gdth driver").

For GDT_PCIMPR controllers, the driver copies up to 256 bytes from the
controller event buffer and later handles the result as a C string.

If the firmware does not provide a NUL byte within the buffer,
gdth_log_event() may read beyond event_string through printk() and
sprintf().

Force the last byte of event_string to NUL after copying it from the
controller. This preserves shorter strings and safely truncates an
unterminated full-length event.

Found by Linux Verification Center (linuxtesting.org) with SVACE.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Co-developed-by: Agalakov Daniil <ade@amicon.ru>
Signed-off-by: Agalakov Daniil <ade@amicon.ru>
Signed-off-by: Daniil Iskhakov <dish@amicon.ru>
---
 drivers/scsi/gdth.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/scsi/gdth.c b/drivers/scsi/gdth.c
index 5d801388680b..744fc1bf1855 100644
--- a/drivers/scsi/gdth.c
+++ b/drivers/scsi/gdth.c
@@ -2562,6 +2562,7 @@ static irqreturn_t __gdth_interrupt(gdth_ha_str *ha,
                         if (ha->dvr.event_string[i] == 0)
                             break;
                     }
+                    ha->dvr.event_string[255] = 0;
                 }
             }
             writeb(0xff, &dp6m_ptr->i960r.edoor_reg);
-- 
2.43.0

Re: [PATCH 5.10] scsi: gdth: ensure event string is NUL-terminated

[Sasha Levin]

> No upstream commit exists for this patch. GDT driver was removed from
> kernel in commit 0653c358d2dc ("scsi: Drop gdth driver").
[...]
> Found by Linux Verification Center (linuxtesting.org) with SVACE.

Since this driver has been gone for the past few years, a maintainer ack will
be appreciated before we pull this in.

Does anyone even care?

-- 
Thanks,
Sasha