| From a4836d5ccadd924668f944a12064843ab0e36c59 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 10 Jun 2025 12:33:38 -0700 |
| Subject: net: ncsi: Fix buffer overflow in fetching version id |
| |
| From: Hari Kalavakunta <kalavakunta.hari.prasad@gmail.com> |
| |
| [ Upstream commit 8e16170ae972c7fed132bc928914a2ffb94690fc ] |
| |
| In NC-SI spec v1.2 section 8.4.44.2, the firmware name doesn't |
| need to be null terminated while its size occupies the full size |
| of the field. Fix the buffer overflow issue by adding one |
| additional byte for null terminator. |
| |
| Signed-off-by: Hari Kalavakunta <kalavakunta.hari.prasad@gmail.com> |
| Reviewed-by: Paul Fertser <fercerpav@gmail.com> |
| Link: https://patch.msgid.link/20250610193338.1368-1-kalavakunta.hari.prasad@gmail.com |
| Signed-off-by: Jakub Kicinski <kuba@kernel.org> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/ncsi/internal.h | 2 +- |
| net/ncsi/ncsi-rsp.c | 1 + |
| 2 files changed, 2 insertions(+), 1 deletion(-) |
| |
| diff --git a/net/ncsi/internal.h b/net/ncsi/internal.h |
| index 2c260f33b55c..ad1f671ffc37 100644 |
| --- a/net/ncsi/internal.h |
| +++ b/net/ncsi/internal.h |
| @@ -110,7 +110,7 @@ struct ncsi_channel_version { |
| u8 update; /* NCSI version update */ |
| char alpha1; /* NCSI version alpha1 */ |
| char alpha2; /* NCSI version alpha2 */ |
| - u8 fw_name[12]; /* Firmware name string */ |
| + u8 fw_name[12 + 1]; /* Firmware name string */ |
| u32 fw_version; /* Firmware version */ |
| u16 pci_ids[4]; /* PCI identification */ |
| u32 mf_id; /* Manufacture ID */ |
| diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c |
| index 8668888c5a2f..d5ed80731e89 100644 |
| --- a/net/ncsi/ncsi-rsp.c |
| +++ b/net/ncsi/ncsi-rsp.c |
| @@ -775,6 +775,7 @@ static int ncsi_rsp_handler_gvi(struct ncsi_request *nr) |
| ncv->alpha1 = rsp->alpha1; |
| ncv->alpha2 = rsp->alpha2; |
| memcpy(ncv->fw_name, rsp->fw_name, 12); |
| + ncv->fw_name[12] = '\0'; |
| ncv->fw_version = ntohl(rsp->fw_version); |
| for (i = 0; i < ARRAY_SIZE(ncv->pci_ids); i++) |
| ncv->pci_ids[i] = ntohs(rsp->pci_ids[i]); |
| -- |
| 2.39.5 |
| |
