[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <b1049e10-95ee-7342-56ec-f0dc683f4759@quicinc.com>
Date: Tue, 1 Aug 2023 12:11:58 +0530
From: Praveenkumar I <quic_ipkumar@...cinc.com>
To: Bjorn Andersson <andersson@...nel.org>
CC: <agross@...nel.org>, <konrad.dybcio@...aro.org>,
<linux-arm-msm@...r.kernel.org>, <linux-kernel@...r.kernel.org>,
<quic_varada@...cinc.com>, <quic_clew@...cinc.com>
Subject: Re: [PATCH v2] soc: qcom: qmi_encdec: Restrict string length in
decode
On 8/1/2023 4:54 AM, Bjorn Andersson wrote:
> On Mon, Jul 31, 2023 at 03:33:11PM +0530, Praveenkumar I wrote:
>> The QMI TLV value for strings in a lot of qmi element info structures
>> account for null terminated strings with MAX_LEN + 1. If a string is
>> actually MAX_LEN + 1 length, this will cause an out of bounds access
>> when the NULL character is appended in decoding.
>>
>> Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder")
>> Cc: stable@...r.kernel.org
>> Signed-off-by: Chris Lew <quic_clew@...cinc.com>
>> Signed-off-by: Praveenkumar I <quic_ipkumar@...cinc.com>
> The signed-off-by list says that Chris certified the patch's origin
> first, then you took it, certified the origin and submitted it to the
> mailing list.
>
> This matches reality, but you lost Chris' authorship in the process,
> please add that back.
Yes, you are right. Will add that, and post it.
- Praveenkumar
> Thanks,
> Bjorn
>
>> ---
>> [v2]:
>> Added Fixes and Cc: stable
>>
>> drivers/soc/qcom/qmi_encdec.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/soc/qcom/qmi_encdec.c b/drivers/soc/qcom/qmi_encdec.c
>> index b7158e3c3a0b..5c7161b18b72 100644
>> --- a/drivers/soc/qcom/qmi_encdec.c
>> +++ b/drivers/soc/qcom/qmi_encdec.c
>> @@ -534,8 +534,8 @@ static int qmi_decode_string_elem(const struct qmi_elem_info *ei_array,
>> decoded_bytes += rc;
>> }
>>
>> - if (string_len > temp_ei->elem_len) {
>> - pr_err("%s: String len %d > Max Len %d\n",
>> + if (string_len >= temp_ei->elem_len) {
>> + pr_err("%s: String len %d >= Max Len %d\n",
>> __func__, string_len, temp_ei->elem_len);
>> return -ETOOSMALL;
>> } else if (string_len > tlv_len) {
>> --
>> 2.34.1
>>
Powered by blists - more mailing lists