control: forwarded -1 https://lore.kernel.org/all/[email protected]/ control: forcemerge -1 1148365
Hi, On 2026-09-19 16:49, Lufei Zheng wrote: > Package: linux-image-7.1.13+deb14-riscv64 > Version: 7.1.13-1 > Severity: important > Tags: upstream > X-Debbugs-Cc: [email protected] > > Dear maintainers, > > arch/riscv/lib/strnlen.S has an integer-overflow bug: for a very large > `count` (in practice `(size_t)-1`) the address computation `s + count` wraps > around 2^64, the loop bound becomes smaller than the start address, and > strnlen() returns a length derived only from the first machine word(typically > 8). The same wrap exists in the byte-loop fallback. The issue has been reported upstream with a patch [1], but it is still under review. If you can test it and send a Tested-by: that would help the patch to get accepted faster. It will get added to the debian kernel once it get fixed upstream. Regards Aurelien [1] https://lore.kernel.org/all/[email protected]/ -- Aurelien Jarno GPG: 4096R/1DDD8C9B [email protected] http://aurel32.net
