Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6b002c74 authored by Kees Cook's avatar Kees Cook Committed by Greg Kroah-Hartman
Browse files

qlge: Avoid reading past end of buffer 




[ Upstream commit df5303a8aa9a0a6934f4cea7427f1edf771f21c2 ]

Using memcpy() from a string that is shorter than the length copied means
the destination buffer is being filled with arbitrary data from the kernel
rodata segment. Instead, use strncpy() which will fill the trailing bytes
with zeros.

This was found with the future CONFIG_FORTIFY_SOURCE feature.

Cc: Daniel Micay <danielmicay@gmail.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <alexander.levin@microsoft.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent f8f828fb

drivers/net/ethernet/qlogic/qlge/qlge_dbg.c

+2 −2
Original line number Diff line number Diff line
@@ -765,7 +765,7 @@ int ql_core_dump(struct ql_adapter *qdev, struct ql_mpi_coredump *mpi_coredump) 
		sizeof(struct mpi_coredump_global_header);

	mpi_coredump->mpi_global_header.imageSize =

		sizeof(struct ql_mpi_coredump);

	memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",

	strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",

		sizeof(mpi_coredump->mpi_global_header.idString));



	/* Get generic NIC reg dump */
@@ -1255,7 +1255,7 @@ static void ql_gen_reg_dump(struct ql_adapter *qdev, 
		sizeof(struct mpi_coredump_global_header);

	mpi_coredump->mpi_global_header.imageSize =

		sizeof(struct ql_reg_dump);

	memcpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",

	strncpy(mpi_coredump->mpi_global_header.idString, "MPI Coredump",

		sizeof(mpi_coredump->mpi_global_header.idString));