Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2215607/?format=api
{ "id": 2215607, "url": "http://patchwork.ozlabs.org/api/patches/2215607/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-tegra/patch/20260324195041.38343-1-sebasjosue84@gmail.com/", "project": { "id": 21, "url": "http://patchwork.ozlabs.org/api/projects/21/?format=api", "name": "Linux Tegra Development", "link_name": "linux-tegra", "list_id": "linux-tegra.vger.kernel.org", "list_email": "linux-tegra@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260324195041.38343-1-sebasjosue84@gmail.com>", "list_archive_url": null, "date": "2026-03-24T19:50:41", "name": "staging: nvec: validate battery response length before memcpy", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "178612adeb924dde673bcf03f6ddd7af9b95fc92", "submitter": { "id": 92955, "url": "http://patchwork.ozlabs.org/api/people/92955/?format=api", "name": "Sebastian Alba Vives", "email": "sebasjosue84@gmail.com" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/linux-tegra/patch/20260324195041.38343-1-sebasjosue84@gmail.com/mbox/", "series": [ { "id": 497342, "url": "http://patchwork.ozlabs.org/api/series/497342/?format=api", "web_url": "http://patchwork.ozlabs.org/project/linux-tegra/list/?series=497342", "date": "2026-03-24T19:50:41", "name": "staging: nvec: validate battery response length before memcpy", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/497342/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2215607/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2215607/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <linux-tegra+bounces-13162-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "linux-tegra@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256\n header.s=20251104 header.b=GC6rNT4j;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c0a:e001:db::12fc:5321; helo=sea.lore.kernel.org;\n envelope-from=linux-tegra+bounces-13162-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=\"GC6rNT4j\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=209.85.217.42", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com", "smtp.subspace.kernel.org;\n spf=pass smtp.mailfrom=gmail.com" ], "Received": [ "from sea.lore.kernel.org (sea.lore.kernel.org\n [IPv6:2600:3c0a:e001:db::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519 server-signature ECDSA (secp384r1) server-digest SHA384)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fgLPr3CXDz1xy1\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 25 Mar 2026 06:56:00 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sea.lore.kernel.org (Postfix) with ESMTP id E9E0930715DF\n\tfor <incoming@patchwork.ozlabs.org>; Tue, 24 Mar 2026 19:50:53 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id CB8043191D6;\n\tTue, 24 Mar 2026 19:50:53 +0000 (UTC)", "from mail-vs1-f42.google.com (mail-vs1-f42.google.com\n [209.85.217.42])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 6E170301474\n\tfor <linux-tegra@vger.kernel.org>; Tue, 24 Mar 2026 19:50:52 +0000 (UTC)", "by mail-vs1-f42.google.com with SMTP id\n ada2fe7eead31-5ffe41e8e83so156009137.1\n for <linux-tegra@vger.kernel.org>;\n Tue, 24 Mar 2026 12:50:52 -0700 (PDT)", "from localhost.localdomain ([2a09:bac5:6d71:aa::11:17b])\n by smtp.gmail.com with ESMTPSA id\n a1e0cc1a2514c-95136b4b8basm12952273241.2.2026.03.24.12.50.49\n (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256);\n Tue, 24 Mar 2026 12:50:50 -0700 (PDT)" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1774381853; cv=none;\n b=bsZ8A/ajp70VT0PlTczhYRuJz6r/apKUyiMyrtVdhCw/w0oABh8HTwAiMP+juid1zHhANa3zE0+p3W/twabCHr3G9DYfhKdKEIjjMNKYebQa9bfXCKN4TRGsEmJffb2DVAAgroK699Uly/uogCMTibgta+mQue1LpkcOPMbFJpA=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1774381853; c=relaxed/simple;\n\tbh=DFzrGNuqedqy8atkxndExskD/dr9k9qOU+KriiRa2NQ=;\n\th=From:To:Cc:Subject:Date:Message-ID:MIME-Version;\n b=mkdJJS44HBCTTdHSbIS/1W8YKP6N0M4PX13dAzWa5y/x3ESpytrePbepV/Nh9wo5Yr4aF/jMng4Fvwwbk/HAZv5tOhgG/Z6q58orqz9RuIR4a/k5dnCkvtvM0ivzbScZqb6MiWjjpTUjKf8YhNf49WmL0Q5s02pdqZpqEViXyR4=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=gmail.com;\n spf=pass smtp.mailfrom=gmail.com;\n dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com\n header.b=GC6rNT4j; arc=none smtp.client-ip=209.85.217.42", "DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=gmail.com; s=20251104; t=1774381851; x=1774986651;\n darn=vger.kernel.org;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:from:to:cc:subject:date:message-id:reply-to;\n bh=Qryctq+sXb4beB+BGrqpu6BjYxUYcgGS3vT4B/l0hBg=;\n b=GC6rNT4j7mM9YW1GxztmbQ2XipS/du4b+9qooanl38rThdP0skbCLL+NJgM+1ckeqj\n Jv6S4lKA8cVkdAfXdmdKPs2FRiX5C5mrKt3F0/bJ9bq56CAtNrsHRAzdYcKJR7nm714y\n /nsGKWiXdz3ZrZvomqbv6JHKKaI+MK2JuPLJmecw6iWWGhpIx7cZasRqnw5M9m8fOAXA\n gFKCeBmIwmtQjp+Z/J6z89Xp0GEVPlu/LgPupOx2BQzeCvDcDn7qyeE4lnTk+bWRQa0/\n sno5wVeC5ZBOxi/rlJHMuZQqCU2xPY7QdGPst+pzEI7ppwBddUaADGdmh8TtXuhPDr2r\n 8PZg==", "X-Google-DKIM-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed;\n d=1e100.net; s=20251104; t=1774381851; x=1774986651;\n h=content-transfer-encoding:mime-version:message-id:date:subject:cc\n :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date\n :message-id:reply-to;\n bh=Qryctq+sXb4beB+BGrqpu6BjYxUYcgGS3vT4B/l0hBg=;\n b=HjJvmFOBHS9WUmCYl918HTYP0sKQM9T4IzcMqqXHsOyK4RrjDB8+l/vNd7u7lqcTcP\n Ga0SfYT/K44o1a03kGcbeLxf9gVjUxGb+mViBv+zc+FO+/bvTpVZpqJ/POJUDfD74Ghj\n HW60DAMr8+jiInUMNerAl3VWbdVebWroNs0wVqL7DCqhx9uotKBvPuFc8dJ5cRc39LeU\n QQRTopSJY7zQTIGxfCUOy9bNxoYdmwL7IfwoFuttcs0J5Kh6o2mwYoEHhWDpjLKk41Mo\n It8Z4MVJ23xujrfa4SaLG24t+lw8IJLzdwnZoxuwMyZuVr1/wmKKx9xe99E/8JXMAeKL\n 5Amw==", "X-Forwarded-Encrypted": "i=1;\n AJvYcCXdb4WvF3l3WWh7pFQad29MlDT3gXi5HrnxaA92bgE19KCB+jh3RqqA3e5LnE4IQB1xJE25wLOYm9GvmA==@vger.kernel.org", "X-Gm-Message-State": "AOJu0YxBsOhAGwgZIQdwqckl+Fooh9lS3YoP55DuCx5V8zjUu3zxknT8\n\tmqBE8zyPXAnN6Ie5hgquRRUOIOuXp1Iw9Ud0K4bVRwQQwLAEpGZHgJJN", "X-Gm-Gg": "ATEYQzzTNqz58c1oiup1nlYG1409yc2iNQjiddYTkeMANdbJ4exe1yoAzI0w7tJND+W\n\tGNGPMRhAcKZ7q1c7ab51BpTGu2qkzm9N4Skfsp+Oo/Wl8CWWP8BmI/ygJ1BphOcjopqqnirpjm6\n\tKb75+oAP5z+Duf/3N2/Z++GaPiTOFMYbXgehJmM8wp6so7GVSywc2xxn/kMxAPunco//AWOVKdh\n\tuNIzVg/5bE+L2g/7W+3vDSJGHd2OGeOZNY+MOB/Ku0uRFtyt+sXnXMI5NcQhXmEszxLrJ7xZE2e\n\tkwAaQYUEHuHrYa0e21ACQ4SK6JrNUOi307PYRU14gLrLRj2/fGHIoJTaUDM1ms+C+U0Fl71AVyF\n\te03gRj5sc0roAPb/EkmSNnJvz1dSJ9CgrjGx+RUoBlXhuywEXN3b9Ncw9qV9ksk/X9RoNQBp4RD\n\t5pHN8ZYgsYoZL9s9+yTs9n5izSuAwzj4DbrM8=", "X-Received": "by 2002:a05:6102:38c8:b0:602:90b8:9840 with SMTP id\n ada2fe7eead31-6031628530emr2537503137.18.1774381851377;\n Tue, 24 Mar 2026 12:50:51 -0700 (PDT)", "From": "Sebastian Josue Alba Vives <sebasjosue84@gmail.com>", "To": "marvin24@gmx.de", "Cc": "ac100@lists.launchpad.net,\n\tlinux-tegra@vger.kernel.org,\n\tlinux-kernel@vger.kernel.org,\n\tstable@vger.kernel.org,\n\tSebastian Josue Alba Vives <sebasjosue84@gmail.com>", "Subject": "[PATCH] staging: nvec: validate battery response length before memcpy", "Date": "Tue, 24 Mar 2026 13:50:41 -0600", "Message-ID": "<20260324195041.38343-1-sebasjosue84@gmail.com>", "X-Mailer": "git-send-email 2.43.0", "Precedence": "bulk", "X-Mailing-List": "linux-tegra@vger.kernel.org", "List-Id": "<linux-tegra.vger.kernel.org>", "List-Subscribe": "<mailto:linux-tegra+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:linux-tegra+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit" }, "content": "In nvec_power_notifier(), the response length from the embedded\ncontroller is used directly as the size argument to memcpy() when\ncopying battery manufacturer, model, and type strings. The\ndestination buffers (bat_manu, bat_model, bat_type) are fixed at 30\nbytes, but res->length is a u8 that can be up to 255, allowing a\nheap buffer overflow.\n\nAdditionally, if res->length is less than 2, the subtraction\nres->length - 2 wraps around as an unsigned value, resulting in a\nlarge copy that corrupts kernel heap memory.\n\nAdd bounds checks before each memcpy to ensure the copy length does\nnot exceed the destination buffer size, and that res->length is at\nleast 2 to prevent unsigned integer underflow.\n\nCc: stable@vger.kernel.org\nSigned-off-by: Sebastian Josue Alba Vives <sebasjosue84@gmail.com>\n---\n drivers/staging/nvec/nvec_power.c | 6 ++++++\n 1 file changed, 6 insertions(+)", "diff": "diff --git a/drivers/staging/nvec/nvec_power.c b/drivers/staging/nvec/nvec_power.c\nindex 2faab9fde..29beef0a7 100644\n--- a/drivers/staging/nvec/nvec_power.c\n+++ b/drivers/staging/nvec/nvec_power.c\n@@ -193,14 +193,20 @@ static int nvec_power_bat_notifier(struct notifier_block *nb,\n \t\tpower->bat_temperature = res->plu - 2732;\n \t\tbreak;\n \tcase MANUFACTURER:\n+\t\tif (res->length < 2 || res->length - 2 > sizeof(power->bat_manu) - 1)\n+\t\t\tbreak;\n \t\tmemcpy(power->bat_manu, &res->plc, res->length - 2);\n \t\tpower->bat_manu[res->length - 2] = '\\0';\n \t\tbreak;\n \tcase MODEL:\n+\t\tif (res->length < 2 || res->length - 2 > sizeof(power->bat_model) - 1)\n+\t\t\tbreak;\n \t\tmemcpy(power->bat_model, &res->plc, res->length - 2);\n \t\tpower->bat_model[res->length - 2] = '\\0';\n \t\tbreak;\n \tcase TYPE:\n+\t\tif (res->length < 2 || res->length - 2 > sizeof(power->bat_type) - 1)\n+\t\t\tbreak;\n \t\tmemcpy(power->bat_type, &res->plc, res->length - 2);\n \t\tpower->bat_type[res->length - 2] = '\\0';\n \t\t/*\n", "prefixes": [] }