Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1733946

[PATCH 4.12 09/52] qlge: avoid memcpy buffer overflow

Show all headers | View raw

4.12-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Arnd Bergmann <arnd@arndb.de>


[ Upstream commit e58f95831e7468d25eb6e41f234842ecfe6f014f ]

gcc-8.0.0 (snapshot) points out that we copy a variable-length string
into a fixed length field using memcpy() with the destination length,
and that ends up copying whatever follows the string:

    inlined from 'ql_core_dump' at drivers/net/ethernet/qlogic/qlge/qlge_dbg.c:1106:2:
drivers/net/ethernet/qlogic/qlge/qlge_dbg.c:708:2: error: 'memcpy' reading 15 bytes from a region of size 14 [-Werror=stringop-overflow=]
  memcpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);

Changing it to use strncpy() will instead zero-pad the destination,
which seems to be the right thing to do here.

The bug is probably harmless, but it seems like a good idea to address
it in stable kernels as well, if only for the purpose of building with
gcc-8 without warnings.

Fixes: a61f80261306 ("qlge: Add ethtool register dump function.")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/ethernet/qlogic/qlge/qlge_dbg.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

--- a/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
+++ b/drivers/net/ethernet/qlogic/qlge/qlge_dbg.c
@@ -724,7 +724,7 @@ static void ql_build_coredump_seg_header
 	seg_hdr->cookie = MPI_COREDUMP_COOKIE;
 	seg_hdr->segNum = seg_number;
 	seg_hdr->segSize = seg_size;
-	memcpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);
+	strncpy(seg_hdr->description, desc, (sizeof(seg_hdr->description)) - 1);
 }
 
 /*

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 4.12 00/52] 4.12.14-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.12 25/52] net/mlx5: Fix arm SRQ command for ISSI version 0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:20 +0200
  [PATCH 4.12 45/52] f2fs: check hot_data for roll-forward recovery Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:40 +0200
  [PATCH 4.12 49/52] fuse: allow server to run in different pid_ns Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:40 +0200
  [PATCH 4.12 52/52] md/raid5: release/flush io in raid5_do_work() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:40 +0200
  [PATCH 4.12 06/52] bpf: fix map value attribute for hash of maps Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 39/52] vhost_net: correctly check tx avail during rx busy polling Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 20/52] packet: Dont write vnet header beyond end of buffer Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 31/52] net/mlx5e: Fix CQ moderation mode not set properly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 21/52] kcm: do not attach PF_KCM sockets to avoid deadlock Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 17/52] cxgb4: Fix stack out-of-bounds read due to wrong size to t4_record_mbox() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 38/52] gianfar: Fix Tx flow control deactivation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 12/52] net: bcmgenet: Be drop monitor friendly Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 23/52] net/mlx5e: Check for qos capability in dcbnl_initialize Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 48/52] x86/switch_to/64: Rewrite FS/GS switching yet again to fix AMD CPUs Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 41/52] ipv6: fix memory leak with multiple tables during netns destruction Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 29/52] net/mlx5: E-Switch, Unload the representors in the correct order Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 33/52] net: fec: Allow reception of frames bigger than 1522 bytes Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 16/52] net: mvpp2: fix the mac address used when using PPv2.2 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 09/52] qlge: avoid memcpy buffer overflow Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 13/52] net: systemport: Free DMA coherent descriptors on errors Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 40/52] ip6_gre: update mtu properly in ip6gre_err Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 43/52] sctp: fix missing wake ups in some situations Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 27/52] net/mlx5e: Dont override user RSS upon set channels Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 19/52] ipv6: do not set sk_destruct in IPV6_ADDRFORM sockopt Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 37/52] Revert "net: fix percpu memory leaks" Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 15/52] udp6: set rx_dst_cookie on rx_dst updates Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 26/52] net/mlx5e: Fix dangling page pointer on DMA mapping error Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 28/52] net/mlx5e: Properly resolve TC offloaded ipv6 vxlan tunnel source address Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 46/52] x86/fsgsbase/64: Fully initialize FS and GS state in start_thread_common Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 11:50 +0200
  [PATCH 4.12 02/52] ipv6: add rcu grace period before freeing fib6_node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.12 03/52] ipv6: fix sparse warning on rt6i_node Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  [PATCH 4.12 10/52] tipc: Fix tipc_sk_reinit handling of -EAGAIN Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-18 12:00 +0200
  Re: [PATCH 4.12 00/52] 4.12.14-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2017-09-18 16:30 +0200
    Re: [PATCH 4.12 00/52] 4.12.14-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2017-09-19 08:40 +0200
      Re: [PATCH 4.12 00/52] 4.12.14-stable review Sudip Mukherjee <sudipm.mukherjee@gmail.com> - 2017-09-20 14:20 +0200
  Re: [PATCH 4.12 00/52] 4.12.14-stable review Guenter Roeck <linux@roeck-us.net> - 2017-09-18 21:30 +0200
  Re: [PATCH 4.12 00/52] 4.12.14-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2017-09-18 22:20 +0200

csiph-web