lkml.org 
[lkml]   [2021]   [Jul]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.12 180/292] PCI/sysfs: Fix dsm_label_utf16s_to_utf8s() buffer overrun
    Date
    From: Krzysztof Wilczyński <kw@linux.com>

    [ Upstream commit bdcdaa13ad96f1a530711c29e6d4b8311eff767c ]

    "utf16s_to_utf8s(..., buf, PAGE_SIZE)" puts up to PAGE_SIZE bytes into
    "buf" and returns the number of bytes it actually put there. If it wrote
    PAGE_SIZE bytes, the newline added by dsm_label_utf16s_to_utf8s() would
    overrun "buf".

    Reduce the size available for utf16s_to_utf8s() to use so there is always
    space for the newline.

    [bhelgaas: reorder patch in series, commit log]
    Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs")
    Link: https://lore.kernel.org/r/20210603000112.703037-7-kw@linux.com
    Reported-by: Joe Perches <joe@perches.com>
    Signed-off-by: Krzysztof Wilczyński <kw@linux.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/pci/pci-label.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
    index 781e45cf60d1..cd84cf52a92e 100644
    --- a/drivers/pci/pci-label.c
    +++ b/drivers/pci/pci-label.c
    @@ -162,7 +162,7 @@ static void dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf)
    len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
    obj->buffer.length,
    UTF16_LITTLE_ENDIAN,
    - buf, PAGE_SIZE);
    + buf, PAGE_SIZE - 1);
    buf[len] = '\n';
    }

    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-19 20:40    [W:4.090 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site