Received-SPF: pass (google.com: domain of linux-kernel+bounces-170540-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
To: Bui Quang Minh <minhquangbui99@gmail.com>
Cc: Jesse Brandeburg <jesse.brandeburg@intel.com>,
        Tony Nguyen
 <anthony.l.nguyen@intel.com>,
        "David S. Miller" <davem@davemloft.net>,
        Eric Dumazet <edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>,
        Paolo Abeni <pabeni@redhat.com>,
        Paul M Stillwell Jr
 <paul.m.stillwell.jr@intel.com>,
        Rasesh Mody <rmody@marvell.com>,
        Sudarsana Kalluru <skalluru@marvell.com>, GR-Linux-NIC-Dev@marvell.com,
        Anil Gurumurthy <anil.gurumurthy@qlogic.com>,
        Sudarsana Kalluru
 <sudarsana.kalluru@qlogic.com>,
        "James E.J. Bottomley"
 <James.Bottomley@HansenPartnership.com>,
        "Martin K. Petersen"
 <martin.petersen@oracle.com>,
        Fabian Frederick <fabf@skynet.be>,
        Saurav
 Kashyap <skashyap@marvell.com>,
        GR-QLogic-Storage-Upstream@marvell.com,
        Nilesh Javali <nilesh.javali@cavium.com>,
        Arun Easi
 <arun.easi@cavium.com>,
        Manish Rangankar <manish.rangankar@cavium.com>,
        Vineeth Vijayan <vneethv@linux.ibm.com>,
        Peter Oberparleiter
 <oberpar@linux.ibm.com>,
        Heiko Carstens <hca@linux.ibm.com>, Vasily
 Gorbik <gor@linux.ibm.com>,
        Alexander Gordeev <agordeev@linux.ibm.com>,
        Christian Borntraeger <borntraeger@linux.ibm.com>,
        Sven Schnelle
 <svens@linux.ibm.com>,
        Sunil Goutham <sgoutham@marvell.com>,
        Linu
 Cherian <lcherian@marvell.com>,
        Geetha sowjanya <gakula@marvell.com>, Jerin Jacob <jerinj@marvell.com>,
        hariprasad <hkelam@marvell.com>,
        Subbaraya Sundeep <sbhatta@marvell.com>,
        intel-wired-lan@lists.osuosl.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-scsi@vger.kernel.org,
        Saurav
 Kashyap <saurav.kashyap@cavium.com>,
        linux-s390@vger.kernel.org, Jens
 Axboe <axboe@kernel.dk>
Subject: Re: [PATCH v2 4/6] qedf: ensure the copied buf is NUL terminated
From: "Martin K. Petersen" <martin.petersen@oracle.com>
In-Reply-To: <20240424-fix-oob-read-v2-4-f1f1b53a10f4@gmail.com> (Bui Quang
	Minh's message of "Wed, 24 Apr 2024 21:44:21 +0700")
Organization: Oracle Corporation
Message-ID: <yq1zft2xvsw.fsf@ca-mkp.ca.oracle.com>
References: <20240424-fix-oob-read-v2-0-f1f1b53a10f4@gmail.com>
	<20240424-fix-oob-read-v2-4-f1f1b53a10f4@gmail.com>
Date: Mon, 06 May 2024 21:20:05 -0400
Content-Type: text/plain
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: 
	=?us-ascii?Q?aNYicGVv8/ONS1jgPHgbAykUnRGM+ACDcqnxg5MDJlhj7RCnHuCeubJa5mhu?=
 =?us-ascii?Q?BD0CdxR5bt1eD2f/RjLyHl0jcVrvQGkVPsJQXLYw0yp4Q4WO475iABn8ALRP?=
 =?us-ascii?Q?FPzBW358rbV+jBhntD0+B56lk7Vzq41MfFx1SmcGZ59UmmN5HyF1+RZpFsnk?=
 =?us-ascii?Q?5M+empKBMh7e8TUh1mc3Lmxo6UunM3uqyi/dF/5roR0keNUSUn1gpZ+L6l/D?=
 =?us-ascii?Q?vigZ40qQzeblEZOc0HMnDkL0suH9m3gMruIU/NhEIr08VlSycxKvsXkAjuXS?=
 =?us-ascii?Q?/7QHHJG1ev1HidIi5+XYyN9O0TnDQItcEoLqeoohy/qJg6QxpzHEew0X1h6W?=
 =?us-ascii?Q?fHXph42LpTKZU4CvenFwuQXTnOi9RFRoM2GmlkV3RokX2XMpJaJsWBZ90YgE?=
 =?us-ascii?Q?t5SqqbZ42iUjluNCeqIYswZBEO/FUcRApPzICNhw/7lFJs/NSmVP1PrWECon?=
 =?us-ascii?Q?hv+XoJB1Q0qTDcJg8Mf7wJP/WdBL0IdjmLUbAOrnhIWCoXBSMS/ul5OUAUHK?=
 =?us-ascii?Q?BkKN4lCgL1GhNpVe09FYkJprQ1R+sg8rSq+ibnH0Ss/Hp5UyyaJwy85LLc8P?=
 =?us-ascii?Q?MlG6KnLcftjVRl86vg/Kdg8024vOMcHd4SESckpOtsiMsWndDWZ+mYm46+7D?=
 =?us-ascii?Q?pOI5deg+k/CX/Cup0f8sxUwk8OUprquL1EYF9OuouZBt7WhEIUDpDZFIqlp0?=
 =?us-ascii?Q?CiXoRpeQE1euXzRIRF4ZONvM0bukNig5OW/bf3nfO44XI8YftwpmQbcRWHaY?=
 =?us-ascii?Q?P5rZbFZvWE8LMOBwHBltIFk9HlepkpHl2y24+qDX7jAUPBZhBfLMvpF2UG7E?=
 =?us-ascii?Q?QNapklIIWtrn+eeVdbR5wSEf1JUa0TY9ShuDo07wuCaZ18kZZ7yKmZXhs/F0?=
 =?us-ascii?Q?YLc0eecTelAffEIL0mbJjfQ/pSKPojmkWiAcfetl12xi/SGMilYppqotdJcw?=
 =?us-ascii?Q?HCm6tYWEiz2e52c9cryFPmmjOZdtBhbu95ZD3cV6nRK64626Z2hnXaqHLh+W?=
 =?us-ascii?Q?rdHZBYfXSSgmL+cC/kIuMR7w+xmAyxT1jv6E3OznFZd5QVnOk8zY242RnWMc?=
 =?us-ascii?Q?10bnr26OIDRSGYYX1iAr4aYD/67K4hdrx4S1iuNIjE2raDX+q4lEx0KJJiAP?=
 =?us-ascii?Q?YvjXcMGiYYT/wOitEjMVK9jtYjk4BixkRrvvx1iSA88Spx0Mw7o3pYZ0LQoj?=
 =?us-ascii?Q?FQNmiIK2wWLsghDbzbK/FQE0Jjbk/CRg7IxHJf5hQ+4IMJvbZO9eDlD4wmjA?=
 =?us-ascii?Q?ELreXQdyBo5bUTcrPePUh2rmBTZcodfsMZglWrrjzB9c/XnCVse/pB4i2PnB?=
 =?us-ascii?Q?QAbVszbCPj1ywkEvoIbj8XmjHtIqDWyoZJMGEZZCr64EeN/fugv7dVLX4RYi?=
 =?us-ascii?Q?XZs0LPdNAIx5nRa2164A+FSZ6TSVGKJXU3JQsMkc0E4gnyjvC+nnvdJqWGQE?=
 =?us-ascii?Q?+vq56a+nr6TF5qlv0alKJF1XHZXigP3P5900+jxNMbSbmF7+Ce1CSLIV53RV?=
 =?us-ascii?Q?GOsJj5+JCxa8w1PwcEDaS282W0lNiJbxzUkscC0JkeHmTJx2gQzXH8mIqJ4b?=
 =?us-ascii?Q?EaVDJ/3x/K7PSLG50XLfIZecPjJUWJR8pehuyqsNz+AriLNIAD+yUY9E9+hT?=
 =?us-ascii?Q?4Q=3D=3D?=
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-ExternalHop-MessageData-0: 
	cGImfEU6d/Jv31pwO+o3SwBupsVqZ6KZhsGPDLZEKTBPFYrBjGzihg9SvZ3fj+aGqYay2eaRdRtLl8+lDzIX8bFzqjFs3UXJM1gyadbbmPiyNDy0IBev9kJg2YhsveH4kzKmkZMtl8c5ZBCK7XAWR5o9yqXtDVN6UyjNWjBp68+UPCBAXotJAW6cOIirRJxUx2uoFsqSJw2O+Kc3yyILjXTD9biG/EGl9HwFAjdliEwQlwnQgZFMD5mYfBkcnofMEE3XtOpPJZ68R5WB6oKcUq7ofQBn8KpS9WH8C3/OS0qJSJYqzYIa7wZYH7yD34CGryhMFguEb+FlM6cbkB4Cpf8YqWk5zuUREKHoELGDMS+1ROEXJQwqqNjY6/TjOAYsn9EFA0iPRRuLttfANp9TAkiTBYCiFNgjIzIiAsaDv5gIIiYpNgpvxiv1hjnuYddkU1tLHq7iTAx34w/E0CejZxquGs2FAvm2KwsXrJqgulPzxA5Dw7BYGL9MKlZ9xLdy58OSUtPGXLZB/FjqZeQaoajHfEGOsO9czalb+Oxk2ohyFI2J5RUmR389kneclXHYd7z4+zl4+leoNIzIzpQE3VS2vmt00JXHaCrY4TzI6Mo=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: d1724c75-4f03-44e3-0316-08dc6e33d64f
X-MS-Exchange-CrossTenant-AuthSource: PH0PR10MB4759.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 07 May 2024 01:20:10.0282
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: f80z5UXqAKe0/5M4OzeObBziN/zB2I7aDwJo7S1zArQcZrKdvTkgwSKxBBpMdpiSL+ZeyPaS3mMTWEnmW16ehCnsBmrUQptKhAzJFfLFY1w=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: CH3PR10MB7612
X-Proofpoint-Virus-Version: vendor=baseguard
 engine=ICAP:2.0.293,Aquarius:18.0.1039,Hydra:6.0.650,FMLib:17.11.176.26
 definitions=2024-05-06_19,2024-05-06_02,2023-05-22_02
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 bulkscore=0 mlxlogscore=999
 phishscore=0 spamscore=0 suspectscore=0 mlxscore=0 malwarescore=0
 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2404010000 definitions=main-2405070009
X-Proofpoint-GUID: 1zG4D5FaTvZiev7CUuwWF1edgCqA_PMw
X-Proofpoint-ORIG-GUID: 1zG4D5FaTvZiev7CUuwWF1edgCqA_PMw


Bui,

> Currently, we allocate a count-sized kernel buffer and copy count from
> userspace to that buffer. Later, we use kstrtouint on this buffer but we
> don't ensure that the string is terminated inside the buffer, this can
> lead to OOB read when using kstrtouint. Fix this issue by using
> memdup_user_nul instead of memdup_user.

Applied to 6.10/scsi-staging, thanks!

-- 
Martin K. Petersen	Oracle Linux Engineering