Skip to content

Commit 1ff337f

Browse files
tobluxgregkh
authored andcommitted
crypto: octeontx - Fix length check to avoid truncation in ucode_load_store
commit 5565a72 upstream. OTX_CPT_UCODE_NAME_LENGTH limits the microcode name to 64 bytes. If a user writes a string of exactly 64 characters, the original code used 'strlen(buf) > 64' to check the length, but then strscpy() copies only 63 characters before adding a NUL terminator, silently truncating the copied string. Fix this off-by-one error by using 'count' directly for the length check to ensure long names are rejected early and copied without truncation. Cc: stable@vger.kernel.org Fixes: d9110b0 ("crypto: marvell - add support for OCTEON TX CPT engine") Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
1 parent c77b33b commit 1ff337f

1 file changed

Lines changed: 1 addition & 1 deletion

File tree

drivers/crypto/marvell/octeontx/otx_cptpf_ucode.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1336,7 +1336,7 @@ static ssize_t ucode_load_store(struct device *dev,
13361336
int del_grp_idx = -1;
13371337
int ucode_idx = 0;
13381338

1339-
if (strlen(buf) > OTX_CPT_UCODE_NAME_LENGTH)
1339+
if (count >= OTX_CPT_UCODE_NAME_LENGTH)
13401340
return -EINVAL;
13411341

13421342
eng_grps = container_of(attr, struct otx_cpt_eng_grps, ucode_load_attr);

0 commit comments

Comments
 (0)