From: Jakub Kicinski <kuba@kernel.org>
To: "Nikhil P. Rao" <nikhil.rao@amd.com>
Cc: <netdev@vger.kernel.org>, <brett.creeley@amd.com>,
<eric.joyner@amd.com>, <andrew+netdev@lunn.ch>,
<davem@davemloft.net>, <edumazet@google.com>, <pabeni@redhat.com>
Subject: Re: [PATCH net] pds_core: fix potential stack info leak in firmware version reporting
Date: Tue, 19 May 2026 19:16:44 -0700 [thread overview]
Message-ID: <20260519191644.1574c9c8@kernel.org> (raw)
In-Reply-To: <20260515212907.998028-2-nikhil.rao@amd.com>
On Fri, 15 May 2026 21:29:06 +0000 Nikhil P. Rao wrote:
> The fw_version field in pds_core_fw_name_info is a fixed 32-byte array
> that may not be null-terminated if firmware writes exactly 32
> characters. When passed to devlink_info_version_stored_put(), this
> could cause a read beyond the array boundary, potentially leaking
> stack contents to userspace or causing a crash if the read crosses
> into an unmapped page.
>
> Null-terminate the firmware version string in place before passing it
> to the devlink API.
This loses the last, presumably meaningful character of the FW version.
Are you saying that device should never send names this long and this
is defensive? Otherwise we could trivially memcpy() the name into a
buffer on the stack that has one extra byte.
Please fix or clarify the commit msg.
--
pw-bot: cr
next prev parent reply other threads:[~2026-05-20 2:16 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-15 21:29 [PATCH net] pds_core: fix potential stack info leak in firmware version reporting Nikhil P. Rao
2026-05-20 2:16 ` Jakub Kicinski [this message]
2026-05-20 20:47 ` Rao, Nikhil
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260519191644.1574c9c8@kernel.org \
--to=kuba@kernel.org \
--cc=andrew+netdev@lunn.ch \
--cc=brett.creeley@amd.com \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=eric.joyner@amd.com \
--cc=netdev@vger.kernel.org \
--cc=nikhil.rao@amd.com \
--cc=pabeni@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox