octeontx2-af: avoid off-by-one read from userspace
authorBui Quang Minh <minhquangbui99@gmail.com>
Wed, 24 Apr 2024 14:44:23 +0000 (21:44 +0700)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Fri, 17 May 2024 09:50:48 +0000 (11:50 +0200)
commitec697fbd38cbe2eef0948b58673b146caa95402f
tree88d6f71f5d593fe1ce84776f5538722b49c260f3
parent0f560240b4cc25d3de527deb257cdf072c0102a9
octeontx2-af: avoid off-by-one read from userspace

[ Upstream commit f299ee709fb45036454ca11e90cb2810fe771878 ]

We try to access count + 1 byte from userspace with memdup_user(buffer,
count + 1). However, the userspace only provides buffer of count bytes and
only these count bytes are verified to be okay to access. To ensure the
copied buffer is NUL terminated, we use memdup_user_nul instead.

Fixes: 3a2eb515d136 ("octeontx2-af: Fix an off by one in rvu_dbg_qsize_write()")
Signed-off-by: Bui Quang Minh <minhquangbui99@gmail.com>
Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-6-f1f1b53a10f4@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/ethernet/marvell/octeontx2/af/rvu_debugfs.c