Re: [PATCH v2 3/6] bfa: ensure the copied buf is NUL terminated

Martin K. Petersen
2024-05-07T01:20:20Z

Bui,

> Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from
> userspace to that buffer. Later, we use sscanf on this buffer but we don't
> ensure that the string is terminated inside the buffer, this can lead to
> OOB read when using sscanf. Fix this issue by using memdup_user_nul
> instead of memdup_user.

Applied to 6.10/scsi-staging, thanks!

--
Martin K. Petersen Oracle Linux Engineering