Hi, On 2026-09-19 11:50, Aurelien Jarno wrote: > control: forwarded -1 > https://lore.kernel.org/all/[email protected]/ > control: forcemerge -1 1148365 > > Hi, > > On 2026-09-19 16:49, Lufei Zheng wrote: > > Package: linux-image-7.1.13+deb14-riscv64 > > Version: 7.1.13-1 > > Severity: important > > Tags: upstream > > X-Debbugs-Cc: [email protected] > > > > Dear maintainers, > > > > arch/riscv/lib/strnlen.S has an integer-overflow bug: for a very large > > `count` (in practice `(size_t)-1`) the address computation `s + count` > > wraps around 2^64, the loop bound becomes smaller than the start address, > > and strnlen() returns a length derived only from the first machine > > word(typically 8). The same wrap exists in the byte-loop fallback. > > The issue has been reported upstream with a patch [1], but it is still > under review. If you can test it and send a Tested-by: that would help > the patch to get accepted faster. > > It will get added to the debian kernel once it get fixed upstream.
The patch got merged upstream in 7.3-rc7 and is is queued for the 7.2.11 stable release. Regards Aurelien -- Aurelien Jarno GPG: 4096R/1DDD8C9B [email protected] http://aurel32.net
