Re: [PATCH] scsi: ufs: Leave space for '\0' in utf8 desc string

From: Daniel Mentz <danielmentz@google.com>
To: Bart Van Assche <bvanassche@acm.org>, Avri Altman <avri.altman@wdc.com>
Cc: "linux-scsi@vger.kernel.org" <linux-scsi@vger.kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	Tomas Winkler <tomas.winkler@intel.com>,
	"Martin K . Petersen" <martin.petersen@oracle.com>,
	Mars Cheng <marscheng@google.com>,
	Yen-lin Lai <yenlinlai@google.com>
Subject: Re: [PATCH] scsi: ufs: Leave space for '\0' in utf8 desc string
Date: Tue, 17 Oct 2023 14:56:33 -0700	[thread overview]
Message-ID: <CAE2F3rCcEC=fMd+_gxwksTW=07ZzAt-vA5SO3w8AdAXGy1OVDg@mail.gmail.com> (raw)
In-Reply-To: <52a248fc-465e-4050-8692-5105b6aaa764@acm.org>

On Tue, Oct 17, 2023 at 12:33 PM Bart Van Assche <bvanassche@acm.org> wrote:
>
> On 10/17/23 12:20, Avri Altman wrote:
> >> Fixes: 4b828fe156a6 ("scsi: ufs: revamp string descriptor reading")
> > I think this code goes back to commit b573d484e4ff (scsi: ufs: add support to read device and string descriptors)
>
> Hmm ... it seems to me that there was no buffer overflow in commit
> b573d484e4ff but that the buffer overflow was introduced by commit
> 4b828fe156a6?

Thank you for the review Avri.

To me, it appears as if those two commits had different issues:

commit b573d484e4ff ("scsi: ufs: add support to read device and string
descriptors") failed to reliably NULL terminate the output string (in
the case where ascii_len == size - QUERY_DESC_HDR_SIZE).

commit 4b828fe156a6 ("scsi: ufs: revamp string descriptor reading")
potentially performs an out-of-bounds array access while NULL
terminating the output string.

I would argue that the proposed fix wouldn't even fix the former and
older commit b573d484e4ff, because that commit might have required
more fixes like using kzalloc instead of kmalloc.
I find that the newer commit 4b828fe156a6 did enough of refactoring
for it to be considered the commit that needs this fix.