[PATCH 0/1] mcb patch for next round

[PATCH 0/1] mcb patch for next round

[Johannes Thumshirn]

Hey Greg, 

here's a mcb patch I forgot to forward you. Thanks Filip for catching my
mistake.

Filip Jensen (1):
  mcb: fix kasan read slab out of bounds

 drivers/mcb/mcb-parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

-- 
2.51.0

[PATCH 1/1] mcb: fix kasan read slab out of bounds

[Johannes Thumshirn]

From: Filip Jensen <dev-Felipe.Jensen@duagon.com>

Fixes the following kasan bug report reproducible when probing the
driver:

slab-out-of-bounds in string_nocheck lib/vsprintf.c:655
slab-out-of-bounds in string+0x396/0x440 lib/vsprintf.c:737
Read of size 1 at addr ffff88810dd32f94 by task modprobe/661

It is caused for passing snprintf a not null terminated string as a
parameter but in the format string expecting one ("%s"), thus making
it read pass the valid data.

Another solution could be giving a length to the snprintf parameter:
        snprintf(bus->name,CHAMELEON_FILENAME_LEN +
1,"%.*s",CHAMELEON_FILENAME_LEN,header->filename);
However, this solution seems less readable and since there is no need
to format the input, apart from converting it into a right C string, a
simple memcpy is here proposed.

Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
Signed-off-by: Filip Jensen <dev-Felipe.Jensen@duagon.com>
Signed-off-by: Johannes Thumshirn <jth@kernel.org>
---
 drivers/mcb/mcb-parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index 7e09a0ea80f8..2b115cb0e5d9 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -200,8 +200,8 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
 	bus->revision = header->revision;
 	bus->model = header->model;
 	bus->minor = header->minor;
-	snprintf(bus->name, CHAMELEON_FILENAME_LEN + 1, "%s",
-		 header->filename);
+	memcpy(bus->name, header->filename, CHAMELEON_FILENAME_LEN);
+	bus->name[CHAMELEON_FILENAME_LEN] = '\0';
 
 	bar_count = chameleon_get_bar(&p, mapbase, &cb);
 	if (bar_count < 0) {
-- 
2.51.0

Re: [PATCH 0/1] mcb patch for next round

[Filip Jensen]

Mr. Kroah-Hartman:

This is a friendly ping for this patch that was accepted some weeks ago.

Thank you very much in advance.

On Mon, 5 Oct 2026, Johannes Thumshirn wrote:

> Hey Greg,
>
> here's a mcb patch I forgot to forward you. Thanks Filip for catching my
> mistake.
>
> Filip Jensen (1):
>  mcb: fix kasan read slab out of bounds
>
> drivers/mcb/mcb-parse.c | 4 ++--
> 1 file changed, 2 insertions(+), 2 deletions(-)
>
> -- 
> 2.51.0
>

Re: [PATCH 0/1] mcb patch for next round

[Greg Kroah-Hartman]

On Mon, Oct 26, 2026 at 08:59:19AM +0100, Filip Jensen wrote:
> Mr. Kroah-Hartman:
> 
> This is a friendly ping for this patch that was accepted some weeks ago.

It's in my "to get to" queue, sorry for the delay.  Given that this is a
very low-priority issue, it will be handled after -rc1 is out, thanks.

greg k-h