Received-SPF: pass (google.com: domain of linux-kernel+bounces-47825-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:4601:e00::3 as permitted sender) client-ip=2604:1380:4601:e00::3;
Message-ID: <dde96dd7-eb33-41ca-9b08-3a2788164d02@linux.intel.com>
Date: Thu, 1 Feb 2024 10:04:23 +0100
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [PATCH] sound: soc: wcd934x: fix an incorrect use of kstrndup()
Content-Language: en-US
To: Mark Brown <broonie@kernel.org>, srinivas.kandagatla@linaro.org,
 bgoswami@quicinc.com, tiwai@suse.com, Fullway Wang <fullwaywang@outlook.com>
Cc: linux-sound@vger.kernel.org, linux-kernel@vger.kernel.org,
 fullwaywang@tencent.com
References: <PH7PR20MB59255EF9DFFB022CB1BBB574BF712@PH7PR20MB5925.namprd20.prod.outlook.com>
 <170662942110.37296.1277489815994094565.b4-ty@kernel.org>
From: =?UTF-8?Q?Amadeusz_S=C5=82awi=C5=84ski?=
 <amadeuszx.slawinski@linux.intel.com>
In-Reply-To: <170662942110.37296.1277489815994094565.b4-ty@kernel.org>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit

On 1/30/2024 4:43 PM, Mark Brown wrote:
> On Thu, 18 Jan 2024 15:52:49 +0800, Fullway Wang wrote:
>> In wcd934x_codec_enable_dec(), kstrndup() is used to alloc memory.
>> However, kmemdup_nul() should be used instead with the size known.
>>
>> This is similar to CVE-2019-12454 which was fixed in commit
>> a549881.
>>
>>
>> [...]
> 
> Applied to
> 
>     https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound.git for-next
> 
> Thanks!
> 

Hi,

Mark, my other comment was meant to stop this patch from being applied 
;), perhaps I could have been more clear? kmemdup_nul() in this case 
will copy bytes behind the end of widget name when copying. Widgets to 
which it applies are named: "ADX MUX0", "ADC MUX1" and so on, until "ADC 
MUX 8", which is 10 bytes including '\0', and kmemdup_nul() will copy 15 
using memcpy().