| Message ID | 20250508130612.82270-3-markus.burri@mt.com (mailing list archive) |
|---|---|
| State | Handled Elsewhere |
| Headers | show |
| Series | Fix potential out-of-bounds error in some drivers | expand |
Reviewed-by: Jacek Lawrynowicz <jacek.lawrynowicz@linux.intel.com> On 5/8/2025 3:06 PM, Markus Burri wrote: > Use the effective written size instead of original size as index for zero > termination. If the input from user-space is to larger and the input is > truncated, the original size is out-of-bound. > Since there is an upfront size check here, the change is for consistency. > > Signed-off-by: Markus Burri <markus.burri@mt.com> > --- > drivers/accel/ivpu/ivpu_debugfs.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/accel/ivpu/ivpu_debugfs.c b/drivers/accel/ivpu/ivpu_debugfs.c > index f0dad0c9ce33..cd24ccd20ba6 100644 > --- a/drivers/accel/ivpu/ivpu_debugfs.c > +++ b/drivers/accel/ivpu/ivpu_debugfs.c > @@ -455,7 +455,7 @@ priority_bands_fops_write(struct file *file, const char __user *user_buf, size_t > if (ret < 0) > return ret; > > - buf[size] = '\0'; > + buf[ret] = '\0'; > ret = sscanf(buf, "%u %u %u %u", &band, &grace_period, &process_grace_period, > &process_quantum); > if (ret != 4)
Thanks for the fix, applied to drm-misc-fixes On 5/8/2025 3:06 PM, Markus Burri wrote: > Use the effective written size instead of original size as index for zero > termination. If the input from user-space is to larger and the input is > truncated, the original size is out-of-bound. > Since there is an upfront size check here, the change is for consistency. > > Signed-off-by: Markus Burri <markus.burri@mt.com> > --- > drivers/accel/ivpu/ivpu_debugfs.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/accel/ivpu/ivpu_debugfs.c b/drivers/accel/ivpu/ivpu_debugfs.c > index f0dad0c9ce33..cd24ccd20ba6 100644 > --- a/drivers/accel/ivpu/ivpu_debugfs.c > +++ b/drivers/accel/ivpu/ivpu_debugfs.c > @@ -455,7 +455,7 @@ priority_bands_fops_write(struct file *file, const char __user *user_buf, size_t > if (ret < 0) > return ret; > > - buf[size] = '\0'; > + buf[ret] = '\0'; > ret = sscanf(buf, "%u %u %u %u", &band, &grace_period, &process_grace_period, > &process_quantum); > if (ret != 4)
diff --git a/drivers/accel/ivpu/ivpu_debugfs.c b/drivers/accel/ivpu/ivpu_debugfs.c index f0dad0c9ce33..cd24ccd20ba6 100644 --- a/drivers/accel/ivpu/ivpu_debugfs.c +++ b/drivers/accel/ivpu/ivpu_debugfs.c @@ -455,7 +455,7 @@ priority_bands_fops_write(struct file *file, const char __user *user_buf, size_t if (ret < 0) return ret; - buf[size] = '\0'; + buf[ret] = '\0'; ret = sscanf(buf, "%u %u %u %u", &band, &grace_period, &process_grace_period, &process_quantum); if (ret != 4)
Use the effective written size instead of original size as index for zero termination. If the input from user-space is to larger and the input is truncated, the original size is out-of-bound. Since there is an upfront size check here, the change is for consistency. Signed-off-by: Markus Burri <markus.burri@mt.com> --- drivers/accel/ivpu/ivpu_debugfs.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)