[PATCH 0/1] mcb: patches for 7.2

[PATCH 0/1] mcb: patches for 7.2

[Johannes Thumshirn]

From: Johannes Thumshirn <johannes.thumshirn@wdc.com>

Hi Greg,

Here's a mcb patch for 7.2 (or 7.1 if you feel like pulling it in for
7.1) from Filip fixing a slab out of bounds read when copying the MCB
FPGA name into the bus->name.

Filip Jensen (1):
  mcb: fix kasan read slab out of bounds

 drivers/mcb/mcb-parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.53.0

[PATCH 1/1] mcb: fix kasan read slab out of bounds

[Johannes Thumshirn]

From: Filip Jensen <dev-Felipe.Jensen@duagon.com>

Fixes the following kasan bug report reproducible when probing the
driver:

slab-out-of-bounds in string_nocheck lib/vsprintf.c:655
slab-out-of-bounds in string+0x396/0x440 lib/vsprintf.c:737
Read of size 1 at addr ffff88810dd32f94 by task modprobe/661

It is caused for passing snprintf a not null terminated string as a
parameter but in the format string expecting one ("%s"), thus making
it read pass the valid data.

Another solution could be giving a length to the snprintf parameter:
        snprintf(bus->name,CHAMELEON_FILENAME_LEN +
1,"%.*s",CHAMELEON_FILENAME_LEN,header->filename);
However, this solution seems less readable and since there is no need
to format the input, apart from converting it into a right C string, a
simple memcpy is here proposed.

Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
Signed-off-by: Filip Jensen <dev-Felipe.Jensen@duagon.com>
Signed-off-by: Johannes Thumshirn <jth@kernel.org>
---
 drivers/mcb/mcb-parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index 7e09a0ea80f8..2b115cb0e5d9 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -200,8 +200,8 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
 	bus->revision = header->revision;
 	bus->model = header->model;
 	bus->minor = header->minor;
-	snprintf(bus->name, CHAMELEON_FILENAME_LEN + 1, "%s",
-		 header->filename);
+	memcpy(bus->name, header->filename, CHAMELEON_FILENAME_LEN);
+	bus->name[CHAMELEON_FILENAME_LEN] = '\0';
 
 	bar_count = chameleon_get_bar(&p, mapbase, &cb);
 	if (bar_count < 0) {
-- 
2.53.0