Re: [PATCH net] pds_core: fix potential stack info leak in firmware version reporting

["Rao, Nikhil" <nikhirao@amd.com>]

On 5/19/2026 7:16 PM, Jakub Kicinski wrote:
>  
> On Fri, 15 May 2026 21:29:06 +0000 Nikhil P. Rao wrote:
>> The fw_version field in pds_core_fw_name_info is a fixed 32-byte array
>> that may not be null-terminated if firmware writes exactly 32
>> characters. When passed to devlink_info_version_stored_put(), this
>> could cause a read beyond the array boundary, potentially leaking
>> stack contents to userspace or causing a crash if the read crosses
>> into an unmapped page.
>>
>> Null-terminate the firmware version string in place before passing it
>> to the devlink API.
> 
> This loses the last, presumably meaningful character of the FW version.
> Are you saying that device should never send names this long and this
> is defensive? Otherwise we could trivially memcpy() the name into a
> buffer on the stack that has one extra byte.
> 
> Please fix or clarify the commit msg.

Thanks for the review.
 
 
 

The firmware already null-terminates these strings, so the fix won't 
truncate any valid data. This is a defensive fix - the driver shouldn't 
rely on firmware behavior.
 
 
 

I'll send v2 with an updated commit message that clarifies this.

Nikhil