torvalds/linux
torvalds/linux
2
0
Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
Code

net: ncsi: Fix buffer overflow in fetching version id

Browse Source 
In NC-SI spec v1.2 section 8.4.44.2, the firmware name doesn't
need to be null terminated while its size occupies the full size
of the field. Fix the buffer overflow issue by adding one
additional byte for null terminator.

Signed-off-by: Hari Kalavakunta <kalavakunta.hari.prasad@gmail.com>
Reviewed-by: Paul Fertser <fercerpav@gmail.com>
Link: https://patch.msgid.link/20250610193338.1368-1-kalavakunta.hari.prasad@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Hari Kalavakunta 2025-06-10 12:33:38 -07:00 committed by Jakub Kicinski
parent 221dfdb2df
commit 8e16170ae9
2 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
net/ncsi/internal.h
View File

@ -110,7 +110,7 @@ struct ncsi_channel_version {
u8 update; /* NCSI version update */ u8 update; /* NCSI version update */
char alpha1; /* NCSI version alpha1 */ char alpha1; /* NCSI version alpha1 */
char alpha2; /* NCSI version alpha2 */ char alpha2; /* NCSI version alpha2 */
u8 fw_name[12]; /* Firmware name string */ u8 fw_name[12 + 1]; /* Firmware name string */
u32 fw_version; /* Firmware version */ u32 fw_version; /* Firmware version */
u16 pci_ids[4]; /* PCI identification */ u16 pci_ids[4]; /* PCI identification */
u32 mf_id; /* Manufacture ID */ u32 mf_id; /* Manufacture ID */

1
net/ncsi/ncsi-rsp.c
View File

@ -775,6 +775,7 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr)
ncv->alpha1 = rsp->alpha1; ncv->alpha1 = rsp->alpha1;
ncv->alpha2 = rsp->alpha2; ncv->alpha2 = rsp->alpha2;
memcpy(ncv->fw_name, rsp->fw_name, 12); memcpy(ncv->fw_name, rsp->fw_name, 12);
ncv->fw_name[12] = '\0';
ncv->fw_version = ntohl(rsp->fw_version); ncv->fw_version = ntohl(rsp->fw_version);
for (i = 0; i < ARRAY_SIZE(ncv->pci_ids); i++) for (i = 0; i < ARRAY_SIZE(ncv->pci_ids); i++)
ncv->pci_ids[i] = ntohs(rsp->pci_ids[i]); ncv->pci_ids[i] = ntohs(rsp->pci_ids[i]);