Andrew Lukoshko
5c58271075
Drop the 687.5.3/687.5.4 security-ahead patches superseded by the RHEL 687.6.1..687.10.1 backports (1100-1104), and add those backports (1100-1196) sourced from centos-stream-9 and upstream stable. Keep the AlmaLinux-ahead smb cifs.spnego fix (retained as 1197). Bump to 5.14.0-687.10.1.
44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
From 62a794efee2f8717d599696c8e1933b675c727e9 Mon Sep 17 00:00:00 2001
|
|
From: Sreekanth Reddy <sreeredd@redhat.com>
|
|
Date: Tue, 19 Aug 2025 14:30:09 -0700
|
|
Subject: [PATCH] RDMA/bnxt_re: Fix buffer overflow in debugfs code
|
|
|
|
JIRA: https://issues.redhat.com/browse/RHEL-108696
|
|
JIRA: https://issues.redhat.com/browse/RHEL-96539
|
|
|
|
commit dbc641ecf1cbd41a649e7ac6ea7175562ef599b2
|
|
Author: Dan Carpenter <dan.carpenter@linaro.org>
|
|
Date: Fri Feb 7 12:16:19 2025 +0300
|
|
|
|
RDMA/bnxt_re: Fix buffer overflow in debugfs code
|
|
|
|
Add some bounds checking to prevent memory corruption in
|
|
bnxt_re_cc_config_set(). This is debugfs code so the bug can only be
|
|
triggered by root.
|
|
|
|
Fixes: 656dff55da19 ("RDMA/bnxt_re: Congestion control settings using debugfs hook")
|
|
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
|
|
Link: https://patch.msgid.link/a6b081ab-55fe-4d0c-8f69-c5e5a59e9141@stanley.mountain
|
|
Acked-by: Selvin Xavier <selvin.xavier@broadcom.com>
|
|
Signed-off-by: Leon Romanovsky <leon@kernel.org>
|
|
|
|
Signed-off-by: Sreekanth Reddy <sreeredd@redhat.com>
|
|
|
|
diff --git a/drivers/infiniband/hw/bnxt_re/debugfs.c b/drivers/infiniband/hw/bnxt_re/debugfs.c
|
|
index f4dd2fb51867..d7354e7753fe 100644
|
|
--- a/drivers/infiniband/hw/bnxt_re/debugfs.c
|
|
+++ b/drivers/infiniband/hw/bnxt_re/debugfs.c
|
|
@@ -285,6 +285,9 @@ static ssize_t bnxt_re_cc_config_set(struct file *filp, const char __user *buffe
|
|
u32 val;
|
|
int rc;
|
|
|
|
+ if (count >= sizeof(buf))
|
|
+ return -EINVAL;
|
|
+
|
|
if (copy_from_user(buf, buffer, count))
|
|
return -EFAULT;
|
|
|
|
--
|
|
2.50.1 (Apple Git-155)
|
|
|