From: "Arnd Bergmann" <arnd@arndb.de>
To: "Miaoqian Lin" <linmq006@gmail.com>,
"Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
"Thomas Weißschuh" <linux@weissschuh.net>,
"Wolfram Sang" <wsa+renesas@sang-engineering.com>,
"Ruan Jinjie" <ruanjinjie@huawei.com>,
"Luca Ceresoli" <luca.ceresoli@bootlin.com>,
linux-kernel@vger.kernel.org
Cc: stable@vger.kernel.org
Subject: Re: [PATCH] misc: eeprom/idt_89hpesx: prevent bad user input in idt_dbgfs_csr_write()
Date: Thu, 30 Oct 2025 09:47:22 +0100 [thread overview]
Message-ID: <0f712780-8af0-4894-b75c-44fd7390dc3e@app.fastmail.com> (raw)
In-Reply-To: <20251030052834.97991-1-linmq006@gmail.com>
On Thu, Oct 30, 2025, at 06:28, Miaoqian Lin wrote:
> A malicious user could pass an arbitrarily bad value
> to memdup_user_nul(), potentially causing kernel crash.
I think you should be more specific than 'kernel crash' here.
As far as I can tell, the worst case would be temporarily
consuming a MAX_ORDER_NR_PAGES allocation, leading to out-of-memory.
> Fixes: 183238ffb886 ("misc: eeprom/idt_89hpesx: Switch to
> memdup_user_nul() helper")
I don't think that patch changed anything, the same thing
would have happened with kmalloc()+copy_from_user().
Am I missing something?
> + if (count == 0 || count > PAGE_SIZE)
> + return -EINVAL;
> +
How did you pick PAGE_SIZE as the maximum here?
Arnd
next prev parent reply other threads:[~2025-10-30 8:47 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-10-30 5:28 Miaoqian Lin
2025-10-30 8:47 ` Arnd Bergmann [this message]
2025-11-03 1:05 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=0f712780-8af0-4894-b75c-44fd7390dc3e@app.fastmail.com \
--to=arnd@arndb.de \
--cc=gregkh@linuxfoundation.org \
--cc=linmq006@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=linux@weissschuh.net \
--cc=luca.ceresoli@bootlin.com \
--cc=ruanjinjie@huawei.com \
--cc=stable@vger.kernel.org \
--cc=wsa+renesas@sang-engineering.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®