mcb patch for next round

Hey Greg,

here's a mcb patch I forgot to forward you. Thanks Filip for catching my mistake.

Filip Jensen (1):
mcb: fix kasan read slab out of bounds

 drivers/mcb/mcb-parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

2.51.0

From: Filip Jensen <[email protected]>

Fixes the following kasan bug report reproducible when probing the driver:

slab-out-of-bounds in string_nocheck lib/vsprintf.c:655 slab-out-of-bounds in string+0x396/0x440 lib/vsprintf.c:737

Read of size 1 at addr ffff88810dd32f94 by task modprobe/661

It is caused for passing snprintf a not null terminated string as a parameter but in the format string expecting one ("%s"), thus making it read pass the valid data.

Another solution could be giving a length to the snprintf parameter:

        snprintf(bus->name,CHAMELEON_FILENAME_LEN +

1,"%.*s",CHAMELEON_FILENAME_LEN,header->filename);
However, this solution seems less readable and since there is no need to format the input, apart from converting it into a right C string, a simple memcpy is here proposed.

---
 drivers/mcb/mcb-parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

index 7e09a0ea80f8..2b115cb0e5d9 100644
@@ -200,8 +200,8 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
 	bus->revision = header->revision;
 	bus->model = header->model;
 	bus->minor = header->minor;
-	snprintf(bus->name, CHAMELEON_FILENAME_LEN + 1, "%s",
-		 header->filename);
+	memcpy(bus->name, header->filename, CHAMELEON_FILENAME_LEN);
+	bus->name[CHAMELEON_FILENAME_LEN] = '\0';
 
 	bar_count = chameleon_get_bar(&p, mapbase, &cb);
 	if (bar_count < 0) {

2.51.0

Mr. Kroah-Hartman:

This is a friendly ping for this patch that was accepted some weeks ago.

Thank you very much in advance.

It's in my "to get to" queue, sorry for the delay. Given that this is a very low-priority issue, it will be handled after -rc1 is out, thanks.

greg k-h