[PATCH] mcb: fix kasan read slab out of bounds

[PATCH] mcb: fix kasan read slab out of bounds

[Filip Jensen]

Fixes the following kasan bug report reproducible when probing the
driver:

slab-out-of-bounds in string_nocheck lib/vsprintf.c:655
slab-out-of-bounds in string+0x396/0x440 lib/vsprintf.c:737
Read of size 1 at addr ffff88810dd32f94 by task modprobe/661

It is caused for passing snprintf a not null terminated string as a
parameter but in the format string expecting one ("%s"), thus making
it read pass the valid data.

Another solution could be giving a length to the snprintf parameter:
        snprintf(bus->name,CHAMELEON_FILENAME_LEN +
1,"%.*s",CHAMELEON_FILENAME_LEN,header->filename);
However, this solution seems less readable and since there is no need
to format the input, apart from converting it into a right C string, a
simple memcpy is here proposed.

Reviewed-by: Jose Javier Rodriguez Barbarin <dev-josejavier.rodriguez@duagon.com>
Signed-off-by: Filip Jensen <dev-Felipe.Jensen@duagon.com>
---
 drivers/mcb/mcb-parse.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/mcb/mcb-parse.c b/drivers/mcb/mcb-parse.c
index bf0d7d58c8b0..85dba7ec1409 100644
--- a/drivers/mcb/mcb-parse.c
+++ b/drivers/mcb/mcb-parse.c
@@ -201,8 +201,8 @@ int chameleon_parse_cells(struct mcb_bus *bus, phys_addr_t mapbase,
 	bus->revision = header->revision;
 	bus->model = header->model;
 	bus->minor = header->minor;
-	snprintf(bus->name, CHAMELEON_FILENAME_LEN + 1, "%s",
-		 header->filename);
+	memcpy(bus->name, header->filename, CHAMELEON_FILENAME_LEN);
+	bus->name[CHAMELEON_FILENAME_LEN] = '\0';
 
 	bar_count = chameleon_get_bar(&p, mapbase, &cb);
 	if (bar_count < 0) {
-- 
2.34.1

Re: [PATCH] mcb: fix kasan read slab out of bounds

[Johannes Thumshirn]

Applied, thanks.

Re: [PATCH] mcb: fix kasan read slab out of bounds

[Filip Jensen]

On Wed, 25 Feb 2026, Johannes Thumshirn wrote:

> Applied, thanks.
>

Hi:

We have noticed this patch has not been uploaded, even though it was 
approved. Is there anything else that we have to do?

Thanks in advance

Re: [PATCH] mcb: fix kasan read slab out of bounds

[Johannes Thumshirn]

On 3/23/26 3:57 PM, Filip Jensen wrote:
>
> On Wed, 25 Feb 2026, Johannes Thumshirn wrote:
>
>> Applied, thanks.
>>
>
> Hi:
>
> We have noticed this patch has not been uploaded, even though it was 
> approved. Is there anything else that we have to do?
>
> Thanks in advance

It is 
https://github.com/morbidrsa/linux/commit/b145fa705320afe371e574555f3852b39bb8bbb8.patch

I haven't forwarded the patch to Greg yet, I ususally do this around 
-rc6 time. I.e. somewhen this or next week.

Byte,

     Johannes