From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755299AbdEHSmY (ORCPT ); Mon, 8 May 2017 14:42:24 -0400 Received: from shards.monkeyblade.net ([184.105.139.130]:34168 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1755164AbdEHSmW (ORCPT ); Mon, 8 May 2017 14:42:22 -0400 Date: Mon, 08 May 2017 14:42:21 -0400 (EDT) Message-Id: <20170508.144221.1326034654665240024.davem@davemloft.net> To: keescook@chromium.org Cc: netdev@vger.kernel.org, harish.patil@cavium.com, manish.chopra@cavium.com, Dept-GELinuxNICDev@cavium.com, linux-kernel@vger.kernel.org, danielmicay@gmail.com Subject: Re: [PATCH] qlge: Avoid reading past end of buffer From: David Miller In-Reply-To: <20170505223434.GA19245@beast> References: <20170505223434.GA19245@beast> X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Mon, 08 May 2017 11:00:53 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Kees Cook Date: Fri, 5 May 2017 15:34:34 -0700 > Using memcpy() from a string that is shorter than the length copied means > the destination buffer is being filled with arbitrary data from the kernel > rodata segment. Instead, use strncpy() which will fill the trailing bytes > with zeros. > > This was found with the future CONFIG_FORTIFY_SOURCE feature. > > Cc: Daniel Micay > Signed-off-by: Kees Cook Applied.