Commit d93a6ca
ibmvnic: Use kernel helpers for hex dumps
Previously, when the driver was printing hex dumps, the buffer was cast
to an 8 byte long and printed using string formatters. If the buffer
size was not a multiple of 8 then a read buffer overflow was possible.
Therefore, create a new ibmvnic function that loops over a buffer and
calls hex_dump_to_buffer instead.
This patch address KASAN reports like the one below:
ibmvnic 30000003 env3: Login Buffer:
ibmvnic 30000003 env3: 01000000af000000
<...>
ibmvnic 30000003 env3: 2e6d62692e736261
ibmvnic 30000003 env3: 65050003006d6f63
==================================================================
BUG: KASAN: slab-out-of-bounds in ibmvnic_login+0xacc/0xffc [ibmvnic]
Read of size 8 at addr c0000001331a9aa8 by task ip/17681
<...>
Allocated by task 17681:
<...>
ibmvnic_login+0x2f0/0xffc [ibmvnic]
ibmvnic_open+0x148/0x308 [ibmvnic]
__dev_open+0x1ac/0x304
<...>
The buggy address is located 168 bytes inside of
allocated 175-byte region [c0000001331a9a00, c0000001331a9aaf)
<...>
=================================================================
ibmvnic 30000003 env3: 000000000033766e
Fixes: 032c5e8 ("Driver for IBM System i/p VNIC protocol")
Signed-off-by: Nick Child <nnac123@linux.ibm.com>
Reviewed-by: Dave Marquardt <davemarq@linux.ibm.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20250320212951.11142-1-nnac123@linux.ibm.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>1 parent 094ee60 commit d93a6ca
1 file changed
+18
-12
lines changed| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
4829 | 4829 | | |
4830 | 4830 | | |
4831 | 4831 | | |
| 4832 | + | |
| 4833 | + | |
| 4834 | + | |
| 4835 | + | |
| 4836 | + | |
| 4837 | + | |
| 4838 | + | |
| 4839 | + | |
| 4840 | + | |
| 4841 | + | |
| 4842 | + | |
| 4843 | + | |
4832 | 4844 | | |
4833 | 4845 | | |
4834 | 4846 | | |
| |||
4939 | 4951 | | |
4940 | 4952 | | |
4941 | 4953 | | |
4942 | | - | |
4943 | | - | |
4944 | | - | |
4945 | | - | |
| 4954 | + | |
| 4955 | + | |
4946 | 4956 | | |
4947 | 4957 | | |
4948 | 4958 | | |
| |||
5319 | 5329 | | |
5320 | 5330 | | |
5321 | 5331 | | |
5322 | | - | |
5323 | 5332 | | |
5324 | 5333 | | |
5325 | 5334 | | |
5326 | 5335 | | |
5327 | 5336 | | |
5328 | | - | |
5329 | | - | |
5330 | | - | |
| 5337 | + | |
| 5338 | + | |
5331 | 5339 | | |
5332 | 5340 | | |
5333 | 5341 | | |
| |||
5558 | 5566 | | |
5559 | 5567 | | |
5560 | 5568 | | |
5561 | | - | |
5562 | | - | |
5563 | | - | |
5564 | | - | |
| 5569 | + | |
| 5570 | + | |
5565 | 5571 | | |
5566 | 5572 | | |
5567 | 5573 | | |
| |||
0 commit comments