archive mirror
 help / color / mirror / Atom feed
From: "Krzysztof Wilczyński" <>
To: Bjorn Helgaas <>
Cc: Logan Gunthorpe <>,
	Joe Perches <>,
	"Oliver O'Halloran" <>,
	Michael Ellerman <>,
	Benjamin Herrenschmidt <>,
	Paul Mackerras <>,
	Tyrel Datwyler <>,
	Russell Currey <>,
	Kurt Schwemmer <>,
	Vidya Sagar <>,
	Xiongfeng Wang <>,
Subject: [PATCH v7 6/6] PCI/sysfs: Fix a buffer overrun problem with dsm_label_utf16s_to_utf8s()
Date: Fri,  4 Jun 2021 13:32:30 +0000	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

When using ACPI to retrieve a device label from _DSM using the
dsm_get_label() function the result can be retrieved either as a string
value or a pointer to a buffer.

Should it be the latter, then an additional function called
dsm_label_utf16s_to_utf8s() will be invoked to convert any UTF16
characters to UTF8 so that the value could be safely stored and later
displayed through a relevant sysfs object.

Internally, dsm_label_utf16s_to_utf8s() calls the utf16s_to_utf8s()
function to handle the conversion setting the limit of the data that can
be saved into a provided buffer as a result of the character conversion
to be a total of PAGE_SIZE.  The utf16s_to_utf8s() function returns an
integer value denoting the number of bytes that have been written into
the provided buffer.

Following the execution of the utf16s_to_utf8s() a newline character
will be added at the end of the resulting buffer so that when the value
is read in the userspace through the sysfs object then it would include
newline making it more accessible when working with the sysfs file
system in the shell, etc.  Normally, this wouldn't be a problem, but if
the function utf16s_to_utf8s() happens to return the number of bytes
written to be precisely PAGE_SIZE, then we would overrun the buffer and
write the newline character outside the allotted space which can have
undefined consequences or result in a failure.

To fix this buffer overrun, ensure that there always is enough space
left for the newline character to be safely appended.

Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs")
Reported-by: Joe Perches <>
Signed-off-by: Krzysztof Wilczyński <>
 drivers/pci/pci-label.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
index 000e169c7197..0c6446519640 100644
--- a/drivers/pci/pci-label.c
+++ b/drivers/pci/pci-label.c
@@ -146,8 +146,8 @@ static int dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf)
 	len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
-			      buf, PAGE_SIZE);
-	buf[len] = '\n';
+			      buf, PAGE_SIZE - 1);
+	buf[len++] = '\n';
 	return len;

  parent reply	other threads:[~2021-06-04 13:32 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-06-04 13:32 [PATCH v7 0/6] PCI/sysfs: Use sysfs_emit() and sysfs_emit_at() in "show" functions Krzysztof Wilczyński
2021-06-04 13:32 ` [PATCH v7 1/6] " Krzysztof Wilczyński
2021-06-04 13:32 ` [PATCH v7 2/6] PCI/sysfs: Use return value from dsm_label_utf16s_to_utf8s() directly Krzysztof Wilczyński
2021-06-04 13:32 ` [PATCH v7 3/6] PCI/sysfs: Fix trailing newline handling of resource_alignment_param Krzysztof Wilczyński
2021-06-04 14:28   ` Bjorn Helgaas
2021-06-04 13:32 ` [PATCH v7 4/6] PCI/sysfs: Add missing trailing newline to devspec_show() Krzysztof Wilczyński
2021-06-04 13:32 ` [PATCH v7 5/6] PCI/sysfs: Only show value when driver_override is not NULL Krzysztof Wilczyński
2021-06-04 13:32 ` Krzysztof Wilczyński [this message]
2021-06-04 14:38 ` [PATCH v7 0/6] PCI/sysfs: Use sysfs_emit() and sysfs_emit_at() in "show" functions Bjorn Helgaas

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).