Re: [PATCH] orangefs: fix a oob in orangefs_debug_write
From: Edward Adam Davis
Date: Sun Dec 22 2024 - 09:00:43 EST
On Sun, 22 Dec 2024 10:35:22 +0000, Al Viro wrote:
> > syzbot report a slab-out-of-bounds Read in orangefs_debug_write. [1]
> >
> > The string passed in from userspace is not terminated with a NULL character,
> > which causes strlen to go out of bounds.
> >
> > Use kstrndup to replace kstrdup.
>
> Better to replace
> if (count > ORANGEFS_MAX_DEBUG_STRING_LEN + 1) {
> silly = count;
> count = ORANGEFS_MAX_DEBUG_STRING_LEN + 1;
> }
> with
> if (count > ORANGEFS_MAX_DEBUG_STRING_LEN) {
> silly = count;
> count = ORANGEFS_MAX_DEBUG_STRING_LEN;
> }
> instead, so that we wouldn't have to deal with lack of NUL anywhere.
Yes, you are right.