Received-SPF: pass (google.com: domain of linux-kernel+bounces-170539-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
To: Bui Quang Minh <minhquangbui99@gmail.com>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>,
        Tony Nguyen
 <anthony.l.nguyen@intel.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Paul M Stillwell Jr
 <paul.m.stillwell.jr@intel.com>,
        Rasesh Mody <rmody@marvell.com>,
        Sudarsana Kalluru <skalluru@marvell.com>, GR-Linux-NIC-Dev@marvell.com,
        Anil Gurumurthy <anil.gurumurthy@qlogic.com>,
        Sudarsana Kalluru
 <sudarsana.kalluru@qlogic.com>,
        "James E.J. Bottomley"
 <James.Bottomley@HansenPartnership.com>,
        "Martin K. Petersen"
 <martin.petersen@oracle.com>,
        Fabian Frederick <fabf@skynet.be>,
        Saurav
 Kashyap <skashyap@marvell.com>,
        GR-QLogic-Storage-Upstream@marvell.com,
        Nilesh Javali <nilesh.javali@cavium.com>,
        Arun Easi
 <arun.easi@cavium.com>,
        Manish Rangankar <manish.rangankar@cavium.com>,
        Vineeth Vijayan <vneethv@linux.ibm.com>,
        Peter Oberparleiter
 <oberpar@linux.ibm.com>,
        Heiko Carstens <hca@linux.ibm.com>, Vasily
 Gorbik <gor@linux.ibm.com>,
        Alexander Gordeev <agordeev@linux.ibm.com>,
        Christian Borntraeger <borntraeger@linux.ibm.com>,
        Sven Schnelle
 <svens@linux.ibm.com>,
        Sunil Goutham <sgoutham@marvell.com>,
        Linu
 Cherian <lcherian@marvell.com>,
        Geetha sowjanya <gakula@marvell.com>, Jerin Jacob <jerinj@marvell.com>,
        hariprasad <hkelam@marvell.com>,
        Subbaraya Sundeep <sbhatta@marvell.com>,
        intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
        Saurav
 Kashyap <saurav.kashyap@cavium.com>,
        linux-s390@vger.kernel.org, Jens
 Axboe <axboe@kernel.dk>
Subject: Re: [PATCH v2 3/6] bfa: ensure the copied buf is NUL terminated
From: "Martin K. Petersen" <martin.petersen@oracle.com>
In-Reply-To: <20240424-fix-oob-read-v2-3-f1f1b53a10f4@gmail.com> (Bui Quang
	Minh's message of "Wed, 24 Apr 2024 21:44:20 +0700")
Organization: Oracle Corporation
Message-ID: <yq15xvqzadt.fsf@ca-mkp.ca.oracle.com>
References: <20240424-fix-oob-read-v2-0-f1f1b53a10f4@gmail.com>
	<20240424-fix-oob-read-v2-3-f1f1b53a10f4@gmail.com>
Date: Mon, 06 May 2024 21:19:52 -0400
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?BCBEnPpoeF20A0Kg4RkQYj0XHGmznv5WsePjWtDcC5vfkPdqZxzhFbo79igQ?=
 =?us-ascii?Q?schIAyUQPkC+jd2aI+0WNWzTp7rdJATcuDWeQDqIuD384DQ3qnkD1+AEu3Hx?=
 =?us-ascii?Q?esuW+xL47Xp8CG/xOAIqJ0PpF3UMroWGOFiR3FE7oo9YSvD1qDnFSLP5iNvm?=
 =?us-ascii?Q?t1SlRT4WgifzrOrgiKwElnEKjWeCpdJPAwk4FX1g4cTGkLnDA7oN1F+8DXkM?=
 =?us-ascii?Q?PYZwQ79Jn7ReryVTkyi9eDWs7lttxOyH9xE64VfeaErOoiww4so5o6cUPxYf?=
 =?us-ascii?Q?ZPmw1VGKgd5c17Q9I8IHOpg91m8tLcdHOQN2li4XbWYbzfbJrJaiCv8lLz3h?=
 =?us-ascii?Q?gSJqqGMwK45Z9NVx7Vm2bmAPQC/g21mOepzmvHBN6C5P8CWIY8pCpGRDBs57?=
 =?us-ascii?Q?W9eJ/vSOKTs81a5TsBm3q5l3wdVKJCDglXGcxmrHdbUVosJjMnKhLAlWNQVw?=
 =?us-ascii?Q?K17CwPtK7GRXJkz7anBaanbhmULkRRWkEoFI4iyKH7uP67Z/MeTbJPn7Rt7t?=
 =?us-ascii?Q?Gu1tnViy+JHzeaWEmN3MF7ZPeMPxCNKDiYa27+6xMY3QTwQbSql1jbSZlKMQ?=
 =?us-ascii?Q?GQye7FKyOfqzabDZqMRdx5xkI+aVTcVmUU1Nh8bLQ9WuU+EXcOmdGEe+KLlH?=
 =?us-ascii?Q?CVwNDcs9PPS6aLF/he7gXcN83F7fDFf128M00Y1QKQWzOmkVz92dP6CglTPy?=
 =?us-ascii?Q?xXOgELIViHXrDoDoBmaqGgFk81BKqBYF4PiS7JGCEoab7hZLODNjXoWmEXKu?=
 =?us-ascii?Q?dH6p9Nvl0AiXhnepOpTk27iDYR8wE4E0TJ5+18KYFxUEuI6/CPMtU58x+Uj9?=
 =?us-ascii?Q?x0Og/sLVdrfpK7JbZNPul8C7JaiFOg/xKTcxHWmYsmU+VcLbU3Fo840Z8H1Y?=
 =?us-ascii?Q?iB3gdWxa/QfY+yDVLrtnwZQZxyZhrQen3aaUDIc+YmEA5qnzYgNdtrCsYc0G?=
 =?us-ascii?Q?ZhbupfLoIjhWGgcirthhJSIykc+A2Ps6h7+NffdKmpu4E21ck8Rb0mkdJhty?=
 =?us-ascii?Q?b46CeeYfi3OezbYSN34+kRq/MpfJ+5psrqzxNCbuXTZ15tCmIv+QRnR21DCV?=
 =?us-ascii?Q?s+K+sc41gzqy7PXo94pjE/K1RFiAQ3/MckuANYGzR8Hklt9+EG6xNapili1U?=
 =?us-ascii?Q?MavGUwdiRJ3TYIF7sPkMA7s7eCZRH3zxG2oSNq6S/hnBjpAXBLTkpy2G4kTp?=
 =?us-ascii?Q?eTzdb671RhehqcP4gNuEsQfpq8GQueStwKnLmtlXk3JXJDYpsapQokqXRTn0?=
 =?us-ascii?Q?tXSeRg4PUM9ZM5aEhKucX+QHrYBFbmXL/sFSaZTBVj5CXpETDsFu3sFgc0cx?=
 =?us-ascii?Q?oKFsqEzt1cgjPAYp9QO+dmAabEeNlZu3fP+eAudxS5JGdWSroXNvBFrqur/F?=
 =?us-ascii?Q?wwQ2wv08Byub9ROXUa/S6WMv2wXH+iQs47gWQ9iEwDN8JZFknpJDBTwwtz3Y?=
 =?us-ascii?Q?FwNontRdShOvb+bOMi8LXeoe6tK0lTR0jl+Qn8Tax/7fqz9xEAuGDxmhToUm?=
 =?us-ascii?Q?H76WrXP/prxIE+eul9LtM8jrfUhPCiDHuIKy4tthRf4NYBXpVDjJlvC+HHiH?=
 =?us-ascii?Q?lCdH+bn2SceLZJpFarrzzqhc61bsJPYS8B2sev63uPR+8h+7Gjd+hDK17wZt?=
 =?us-ascii?Q?Lw=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	OWD45tU+yhYi6e5bnymYKs0lY6WAg21Y9JcqKj6D+xRJmW1RShsjj8cniZ7et0QhoahNb+tUlLic1AwOOu+3wUwpWo7Gxv430qz3t3kMwA0rIIFrAWIOhULGDw8NNPC+QyZRKdIHOunRfbty1ZAmafJxOELj5MPt1W9zYfEKyq68YqygOOPWwbQbna0qOmg0r50k9OFy+tNS+Atch0dfZydjfgh1I0y0pYPIMFYdvbREDWUOlnEa/9xh21ngGmGXLVGLMuOlohW43OXunQPa/kt+lsmLeuxBdRrCRJaa4J5axt0652iIuVzOJwD/HhuuUFeyRVGYdgQrsFdMizD099x4XmnAG4wSkBzq8xOxWAZfUAPzh+XMbYhsXIHgHxAaBVx3m9QfCMEQYzmyFbvZ9vxsXm2AK9IEO+Kzw9EMMpSK1Z8V2w+g/g9O7uZi1lngSZry+Fi3/EaeI7GGEENHjRNeeRL6m50l9P+BaMa+sPvJP0rpARYaTl+DZFUcev4MVmn1yfO5TgdNucS7hDr6YuuyEdKfvrTC6wbUbBWMHv+MiJAgcawfEyJrCDevt7PmaL/29OIOstDqXe6BDCv8wEtx/GHdgGOt9vze/GvYzW0=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 939d7412-1d7e-429d-9718-08dc6e33ccee
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB4759.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 May 2024 01:19:54.2125
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 3FJDhlDHkx8N+8kxkpykN/1FPc8BzsegdL2940fu1fSIMacRXF9n5dFqKsCNhEDRzu5qlzFawYJza+cwdwHqskPKRGMc3nAew/g48jFvOpI=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR10MB7612
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.650,FMLib:17.11.176.26
 definitions=2024-05-06_19,2024-05-06_02,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 spamscore=0 suspectscore=0
 mlxlogscore=999 bulkscore=0 mlxscore=0 adultscore=0 malwarescore=0
 phishscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2404010000 definitions=main-2405070009
X-Proofpoint-GUID: wIwkuZulSmMrACr2azrjBQ2XQbA7wzXp
X-Proofpoint-ORIG-GUID: wIwkuZulSmMrACr2azrjBQ2XQbA7wzXp


Bui,

> Currently, we allocate a nbytes-sized kernel buffer and copy nbytes from
> userspace to that buffer. Later, we use sscanf on this buffer but we don't
> ensure that the string is terminated inside the buffer, this can lead to
> OOB read when using sscanf. Fix this issue by using memdup_user_nul
> instead of memdup_user.

Applied to 6.10/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering