diff options
| author | Oleksandr Natalenko <[email protected]> | 2023-07-31 10:40:33 +0200 |
|---|---|---|
| committer | Martin K. Petersen <[email protected]> | 2023-07-31 14:42:59 -0400 |
| commit | 31b5991a9a91ba97237ac9da509d78eec453ff72 (patch) | |
| tree | 283d99636ad83a9fadba8b6cecb9b0783ddc3647 | |
| parent | 7d3d20dee4f648ec44e9717d5f647d594d184433 (diff) | |
scsi: qedf: Do not touch __user pointer in qedf_dbg_debug_cmd_read() directly
The qedf_dbg_debug_cmd_read() function invokes sprintf() directly on a
__user pointer, which may crash the kernel.
Avoid doing that by using a small on-stack buffer for scnprintf() and then
calling simple_read_from_buffer() which does a proper copy_to_user() call.
Fixes: 61d8658b4a43 ("scsi: qedf: Add QLogic FastLinQ offload FCoE driver framework.")
Link: https://lore.kernel.org/lkml/[email protected]/
Link: https://lore.kernel.org/linux-scsi/[email protected]/
Cc: Saurav Kashyap <[email protected]>
Cc: Rob Evers <[email protected]>
Cc: Johannes Thumshirn <[email protected]>
Cc: David Laight <[email protected]>
Cc: Jozef Bacik <[email protected]>
Cc: Laurence Oberman <[email protected]>
Cc: "James E.J. Bottomley" <[email protected]>
Cc: "Martin K. Petersen" <[email protected]>
Cc: [email protected]
Cc: [email protected]
Reviewed-by: Laurence Oberman <[email protected]>
Reviewed-by: Johannes Thumshirn <[email protected]>
Tested-by: Laurence Oberman <[email protected]>
Acked-by: Saurav Kashyap <[email protected]>
Signed-off-by: Oleksandr Natalenko <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Martin K. Petersen <[email protected]>
| -rw-r--r-- | drivers/scsi/qedf/qedf_debugfs.c | 7 |
1 files changed, 3 insertions, 4 deletions
diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c index 3eb4334ac6a3..1c5716540e46 100644 --- a/drivers/scsi/qedf/qedf_debugfs.c +++ b/drivers/scsi/qedf/qedf_debugfs.c @@ -138,15 +138,14 @@ qedf_dbg_debug_cmd_read(struct file *filp, char __user *buffer, size_t count, loff_t *ppos) { int cnt; + char cbuf[32]; struct qedf_dbg_ctx *qedf_dbg = (struct qedf_dbg_ctx *)filp->private_data; QEDF_INFO(qedf_dbg, QEDF_LOG_DEBUGFS, "debug mask=0x%x\n", qedf_debug); - cnt = sprintf(buffer, "debug mask = 0x%x\n", qedf_debug); + cnt = scnprintf(cbuf, sizeof(cbuf), "debug mask = 0x%x\n", qedf_debug); - cnt = min_t(int, count, cnt - *ppos); - *ppos += cnt; - return cnt; + return simple_read_from_buffer(buffer, count, ppos, cbuf, cnt); } static ssize_t |