Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/1.2/patches/2224252/?format=api
{ "id": 2224252, "url": "http://patchwork.ozlabs.org/api/1.2/patches/2224252/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-um/patch/20260417074056.6937-1-pengpeng@iscas.ac.cn/", "project": { "id": 60, "url": "http://patchwork.ozlabs.org/api/1.2/projects/60/?format=api", "name": "User-mode Linux Development", "link_name": "linux-um", "list_id": "linux-um.lists.infradead.org", "list_email": "linux-um@lists.infradead.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260417074056.6937-1-pengpeng@iscas.ac.cn>", "list_archive_url": null, "date": "2026-04-17T07:40:56", "name": "um: vfio: bound the iommu_group sysfs path formatting", "commit_ref": null, "pull_url": null, "state": "changes-requested", "archived": false, "hash": "b3ee75ee0f3076340baa4db3a9472ab5232ea405", "submitter": { "id": 93000, "url": "http://patchwork.ozlabs.org/api/1.2/people/93000/?format=api", "name": "Pengpeng Hou", "email": "pengpeng@iscas.ac.cn" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-um/patch/20260417074056.6937-1-pengpeng@iscas.ac.cn/mbox/", "series": [ { "id": 500255, "url": "http://patchwork.ozlabs.org/api/1.2/series/500255/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-um/list/?series=500255", "date": "2026-04-17T07:40:56", "name": "um: vfio: bound the iommu_group sysfs path formatting", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500255/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2224252/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2224252/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n secure) header.d=lists.infradead.org header.i=@lists.infradead.org\n header.a=rsa-sha256 header.s=bombadil.20210309 header.b=RD3WDDKO;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=none (no SPF record) smtp.mailfrom=lists.infradead.org\n (client-ip=2607:7c80:54:3::133; helo=bombadil.infradead.org;\n envelope-from=linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from bombadil.infradead.org (bombadil.infradead.org\n [IPv6:2607:7c80:54:3::133])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fxmyq1KsNz1yGt\n\tfor <incoming@patchwork.ozlabs.org>; Fri, 17 Apr 2026 17:41:07 +1000 (AEST)", "from localhost ([::1] helo=bombadil.infradead.org)\n\tby bombadil.infradead.org with esmtp (Exim 4.98.2 #2 (Red Hat Linux))\n\tid 1wDdp2-00000003c0l-1Abe;\n\tFri, 17 Apr 2026 07:41:04 +0000", "from smtp25.cstnet.cn ([159.226.251.25] helo=cstnet.cn)\n\tby bombadil.infradead.org with esmtps (Exim 4.98.2 #2 (Red Hat Linux))\n\tid 1wDdoz-00000003c0L-3opv\n\tfor linux-um@lists.infradead.org;\n\tFri, 17 Apr 2026 07:41:03 +0000", "from localhost.localdomain (unknown [111.196.245.116])\n\tby APP-05 (Coremail) with SMTP id zQCowAAnfhEK5OFpCQnYDQ--.60278S2;\n\tFri, 17 Apr 2026 15:40:58 +0800 (CST)" ], "DKIM-Signature": "v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;\n\td=lists.infradead.org; s=bombadil.20210309; h=Sender:List-Subscribe:List-Help\n\t:List-Post:List-Archive:List-Unsubscribe:List-Id:Content-Transfer-Encoding:\n\tMIME-Version:Message-ID:Date:Subject:Cc:To:From:Reply-To:Content-Type:\n\tContent-ID:Content-Description:Resent-Date:Resent-From:Resent-Sender:\n\tResent-To:Resent-Cc:Resent-Message-ID:In-Reply-To:References:List-Owner;\n\tbh=kxo1Wb+M6Nkal9euSt7glrlpHKcTagXDGbTG3uGiMJo=; b=RD3WDDKOVahSmVQ0PgYEy2zGuU\n\t+LWrWAPmGHVRJQ5AovxzaH6pXTsNi3iLbS+6fRrsmtV4L+Uu7pyVxd+336tY+0f0F0cI4yFKVABsc\n\tQ/wAJv6Gbt/Koz5mWgd3Jp0Y3TnkI5Jk330N8VJr3R16uNTbSepHKjBQJO0gxqd29vIa9hU3KWI5V\n\tAJ7qAlq6rfaShjXW7u/oNN5U+0/NtyV23++MCsfuY2zqbGPawRr2tytpJwYTD/jwI8YEsyH5Qescx\n\tlojZEnnFEfA3w7BBlWhYT0Ik4q2F4NFryvk5YDd0DpOlQt5pt/DVzoO/N4fErNHxa8geN2gqS7lXZ\n\tl2+XYc9g==;", "From": "Pengpeng Hou <pengpeng@iscas.ac.cn>", "To": "Richard Weinberger <richard@nod.at>,\n\tAnton Ivanov <anton.ivanov@cambridgegreys.com>", "Cc": "Johannes Berg <johannes@sipsolutions.net>,\n\tTiwei Bie <tiwei.btw@antgroup.com>,\n\tlinux-um@lists.infradead.org,\n\tlinux-kernel@vger.kernel.org,\n\tPengpeng Hou <pengpeng@iscas.ac.cn>", "Subject": "[PATCH] um: vfio: bound the iommu_group sysfs path formatting", "Date": "Fri, 17 Apr 2026 15:40:56 +0800", "Message-ID": "<20260417074056.6937-1-pengpeng@iscas.ac.cn>", "X-Mailer": "git-send-email 2.50.1", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-CM-TRANSID": "zQCowAAnfhEK5OFpCQnYDQ--.60278S2", "X-Coremail-Antispam": "1UD129KBjvdXoWrtFW5CFW3Kr1UGryDJr1fZwb_yoWktFg_u3\n\t9ruF1DG348GF1rZrnIy34fA3yYy3yavrW8uayDtasayF9rZryUZF1Ikryft3WUXa4fZF4D\n\tX393tryxAr10gjkaLaAFLSUrUUUUjb8apTn2vfkv8UJUUUU8Yxn0WfASr-VFAUDa7-sFnT\n\t9fnUUIcSsGvfJTRUUUb4AFF20E14v26r4j6ryUM7CY07I20VC2zVCF04k26cxKx2IYs7xG\n\t6rWj6s0DM7CIcVAFz4kK6r1j6r18M28lY4IEw2IIxxk0rwA2F7IY1VAKz4vEj48ve4kI8w\n\tA2z4x0Y4vE2Ix0cI8IcVAFwI0_Ar0_tr1l84ACjcxK6xIIjxv20xvEc7CjxVAFwI0_Gr1j\n\t6F4UJwA2z4x0Y4vEx4A2jsIE14v26rxl6s0DM28EF7xvwVC2z280aVCY1x0267AKxVW0oV\n\tCq3wAS0I0E0xvYzxvE52x082IY62kv0487Mc02F40EFcxC0VAKzVAqx4xG6I80ewAv7VC0\n\tI7IYx2IY67AKxVWUAVWUtwAv7VC2z280aVAFwI0_Gr0_Cr1lOx8S6xCaFVCjc4AY6r1j6r\n\t4UM4x0Y48IcxkI7VAKI48JM4x0x7Aq67IIx4CEVc8vx2IErcIFxwCY1x0262kKe7AKxVWU\n\tAVWUtwCF04k20xvY0x0EwIxGrwCFx2IqxVCFs4IE7xkEbVWUJVW8JwC20s026c02F40E14\n\tv26r1j6r18MI8I3I0E7480Y4vE14v26r106r1rMI8E67AF67kF1VAFwI0_JF0_Jw1lIxkG\n\tc2Ij64vIr41lIxAIcVC0I7IYx2IY67AKxVWUCVW8JwCI42IY6xIIjxv20xvEc7CjxVAFwI\n\t0_Cr0_Gr1UMIIF0xvE42xK8VAvwI8IcIk0rVWUJVWUCwCI42IY6I8E87Iv67AKxVW8JVWx\n\tJwCI42IY6I8E87Iv6xkF7I0E14v26r4UJVWxJrUvcSsGvfC2KfnxnUUI43ZEXa7VUjZNVP\n\tUUUUU==", "X-Originating-IP": "[111.196.245.116]", "X-CM-SenderInfo": "pshqw1xhqjqxpvfd2hldfou0/", "X-CRM114-Version": "20100106-BlameMichelson ( TRE 0.8.0 (BSD) ) MR-646709E3 ", "X-CRM114-CacheID": "sfid-20260417_004102_337845_5FFD40C4 ", "X-CRM114-Status": "UNSURE ( 7.89 )", "X-CRM114-Notice": "Please train this message.", "X-Spam-Score": "-1.9 (-)", "X-Spam-Report": "Spam detection software,\n running on the system \"bombadil.infradead.org\",\n has NOT identified this incoming email as spam. The original\n message has been attached to this so you can view it or label\n similar future email. If you have any questions, see\n the administrator of that system for details.\n Content preview: uml_vfio_user_get_group_id() builds the iommu_group sysfs\n path in a PATH_MAX buffer with sprintf() and an unvalidated device string.\n If the device component is long enough, the formatted path runs past the\n end of the heap buffer before readlink() is attempted.\n Content analysis details: (-1.9 points, 5.0 required)\n pts rule name description\n ---- ----------------------\n --------------------------------------------------\n -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at https://www.dnswl.org/, no\n trust\n [159.226.251.25 listed in list.dnswl.org]\n 0.0 RCVD_IN_VALIDITY_CERTIFIED_BLOCKED RBL: ADMINISTRATOR NOTICE: The\n query to Validity was blocked. See\n https://knowledge.validity.com/hc/en-us/articles/20961730681243\n for more information.\n [159.226.251.25 listed in\n sa-trusted.bondedsender.org]\n 0.0 RCVD_IN_VALIDITY_SAFE_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to\n Validity was blocked. See\n https://knowledge.validity.com/hc/en-us/articles/20961730681243\n for more information.\n [159.226.251.25 listed in sa-accredit.habeas.com]\n -0.0 SPF_PASS SPF: sender matches SPF record\n -0.0 SPF_HELO_PASS SPF: HELO matches SPF record\n -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%\n [score: 0.0000]\n 0.0 RCVD_IN_VALIDITY_RPBL_BLOCKED RBL: ADMINISTRATOR NOTICE: The query to\n Validity was blocked. See\n https://knowledge.validity.com/hc/en-us/articles/20961730681243\n for more information.\n [159.226.251.25 listed in\n bl.score.senderscore.com]", "X-BeenThere": "linux-um@lists.infradead.org", "X-Mailman-Version": "2.1.34", "Precedence": "list", "List-Id": "<linux-um.lists.infradead.org>", "List-Unsubscribe": "<http://lists.infradead.org/mailman/options/linux-um>,\n <mailto:linux-um-request@lists.infradead.org?subject=unsubscribe>", "List-Archive": "<http://lists.infradead.org/pipermail/linux-um/>", "List-Post": "<mailto:linux-um@lists.infradead.org>", "List-Help": "<mailto:linux-um-request@lists.infradead.org?subject=help>", "List-Subscribe": "<http://lists.infradead.org/mailman/listinfo/linux-um>,\n <mailto:linux-um-request@lists.infradead.org?subject=subscribe>", "Sender": "\"linux-um\" <linux-um-bounces@lists.infradead.org>", "Errors-To": "linux-um-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org" }, "content": "uml_vfio_user_get_group_id() builds the iommu_group sysfs path in a\nPATH_MAX buffer with sprintf() and an unvalidated device string.\n\nIf the device component is long enough, the formatted path runs past the\nend of the heap buffer before readlink() is attempted.\n\nUse snprintf() and reject device strings whose formatted path does not\nfit in PATH_MAX.\n\nFixes: a0e2cb6a9063 (\"um: Add VFIO-based virtual PCI driver\")\n\nSigned-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>\n---\n arch/um/drivers/vfio_user.c | 7 ++++++-\n 1 file changed, 6 insertions(+), 1 deletion(-)", "diff": "diff --git a/arch/um/drivers/vfio_user.c b/arch/um/drivers/vfio_user.c\nindex 6a45d8e14582..5230e18b5b53 100644\n--- a/arch/um/drivers/vfio_user.c\n+++ b/arch/um/drivers/vfio_user.c\n@@ -81,7 +81,12 @@ int uml_vfio_user_get_group_id(const char *device)\n \tif (!path)\n \t\treturn -ENOMEM;\n \n-\tsprintf(path, \"/sys/bus/pci/devices/%s/iommu_group\", device);\n+\tr = snprintf(path, PATH_MAX, \"/sys/bus/pci/devices/%s/iommu_group\",\n+\t\t device);\n+\tif (r >= PATH_MAX) {\n+\t\tr = -ENAMETOOLONG;\n+\t\tgoto free_path;\n+\t}\n \n \tbuf = uml_kmalloc(PATH_MAX + 1, UM_GFP_KERNEL);\n \tif (!buf) {\n", "prefixes": [] }