Subject: Re: [PATCH net] pds_core: fix potential stack info leak in firmware version reporting

From: Jakub Kicinski <[email-masked]>
Date: Tue, 19 May 2026 19:16:44 -0700

On Fri, 15 May 2026 21:29:06 +0000 Nikhil P. Rao wrote:
> The fw_version field in pds_core_fw_name_info is a fixed 32-byte array
> that may not be null-terminated if firmware writes exactly 32
> characters. When passed to devlink_info_version_stored_put(), this
> could cause a read beyond the array boundary, potentially leaking
> stack contents to userspace or causing a crash if the read crosses
> into an unmapped page.
> 
> Null-terminate the firmware version string in place before passing it
> to the devlink API.

This loses the last, presumably meaningful character of the FW version.
Are you saying that device should never send names this long and this
is defensive? Otherwise we could trivially memcpy() the name into a
buffer on the stack that has one extra byte.

Please fix or clarify the commit msg.
-- 
pw-bot: cr