mlxbf-bootctl: Fix kernel panic due to buffer overflow

Bug #2028309 reported by Asmaa Mnebhi
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-bluefield (Ubuntu)
Invalid
Undecided
Unassigned
Jammy
Fix Committed
Undecided
Unassigned

Bug Description

SRU Justification:

[Impact]

Running the following LTP (linux-test-project) script, causes
a kernel panic and a reboot of the DPU:
ltp/testcases/bin/read_all -d /sys -q -r 10

The above test reads all directory and files under /sys.
Reading the sysfs entry "large_icm" causes the kernel panic
due to a garbage value returned via i2c read. That garbage
value causes a buffer overflow in sprintf.

[Fix]

* Replace sprintf with snprintf. And also add missing lock and
increase the buffer size to PAGE_SIZE.

[Test Case]

* Run from linux:
ltp/testcases/bin/read_all -d /sys -q -r 10

[Regression Potential]

no known regression

Changed in linux-bluefield (Ubuntu):
status: New → Invalid
Changed in linux-bluefield (Ubuntu Jammy):
status: New → Fix Committed
Revision history for this message
Bartlomiej Zolnierkiewicz (bzolnier) wrote :

This bug is awaiting verification that the linux-bluefield/5.15.0-1020.22 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-jammy' to 'verification-done-jammy'. If the problem still exists, change the tag 'verification-needed-jammy' to 'verification-failed-jammy'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

tags: added: verification-needed-jammy
Tien Do (tienmdo)
tags: added: verification-done-jammy
removed: verification-needed-jammy
To post a comment you must log in.
This report contains Public information  
Everyone can see this information.

Other bug subscribers

Remote bug watches

Bug watches keep track of this bug in other bug trackers.