Merge branch 'ensure-the-copied-buf-is-nul-terminated'
authorJakub Kicinski <kuba@kernel.org>
Fri, 26 Apr 2024 02:23:51 +0000 (19:23 -0700)
committerJakub Kicinski <kuba@kernel.org>
Fri, 26 Apr 2024 02:23:51 +0000 (19:23 -0700)
Bui Quang Minh says:

====================
Ensure the copied buf is NUL terminated (part)

I found that some drivers contains an out-of-bound read pattern like this

kern_buf = memdup_user(user_buf, count);
...
sscanf(kern_buf, ...);

The sscanf can be replaced by some other string-related functions. This
pattern can lead to out-of-bound read of kern_buf in string-related
functions.

This series fix the above issue by replacing memdup_user with
memdup_user_nul.

v1: https://lore.kernel.org/r/20240422-fix-oob-read-v1-0-e02854c30174@gmail.com
====================

Link: https://lore.kernel.org/r/20240424-fix-oob-read-v2-0-f1f1b53a10f4@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Trivial merge