linux-kernel - RE: [PATCH v2 2/3] scsi: ufs: core: fix incorrect buffer duplication in ufshcd_read_string

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <PH7PR16MB6196EB54F847DD32DE097770E5E6A@PH7PR16MB6196.namprd16.prod.outlook.com>
Date: Wed, 1 Oct 2025 10:03:10 +0000
From: Avri Altman <Avri.Altman@...disk.com>
To: Bean Huo <beanhuo@...pp.de>, "avri.altman@....com" <avri.altman@....com>,
	"bvanassche@....org" <bvanassche@....org>, "alim.akhtar@...sung.com"
	<alim.akhtar@...sung.com>, "jejb@...ux.ibm.com" <jejb@...ux.ibm.com>,
	"martin.petersen@...cle.com" <martin.petersen@...cle.com>,
	"can.guo@....qualcomm.com" <can.guo@....qualcomm.com>,
	"ulf.hansson@...aro.org" <ulf.hansson@...aro.org>, "beanhuo@...ron.com"
	<beanhuo@...ron.com>, "jens.wiklander@...aro.org" <jens.wiklander@...aro.org>
CC: "linux-scsi@...r.kernel.org" <linux-scsi@...r.kernel.org>,
	"linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>
Subject: RE: [PATCH v2 2/3] scsi: ufs: core: fix incorrect buffer duplication
 in ufshcd_read_string_desc()

> From: Bean Huo <beanhuo@...ron.com>
> 
> The function ufshcd_read_string_desc() was duplicating memory starting from
> the beginning of struct uc_string_id, which included the length and type
> fields. As a result, the allocated buffer contained unwanted metadata in
> addition to the string itself.
> 
> The correct behavior is to duplicate only the Unicode character array in the
> structure. Update the code so that only the actual string content is copied into
> the new buffer.
2 Nits - only If you'll have another spin:
Nit 1: maybe add one more sentence: This does not imply any ABI change as there are no current callers with SD_RAW
Nit 2: you might want to remove the duplicate definitions of SD_ASCII_STD & SD_RAW

> 
> Fixes: 5f57704dbcfe ("scsi: ufs: Use kmemdup in ufshcd_read_string_desc()")
> Signed-off-by: Bean Huo <beanhuo@...ron.com>
Reviewed-by: Avri Altman <avri.altman@...disk.com>


> ---
>  drivers/ufs/core/ufshcd.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/ufs/core/ufshcd.c b/drivers/ufs/core/ufshcd.c index
> 2e1fa8cf83f5..79c7588be28a 100644
> --- a/drivers/ufs/core/ufshcd.c
> +++ b/drivers/ufs/core/ufshcd.c
> @@ -3823,7 +3823,7 @@ int ufshcd_read_string_desc(struct ufs_hba *hba,
> u8 desc_index,
>                 str[ret++] = '\0';
> 
>         } else {
> -               str = kmemdup(uc_str, uc_str->len, GFP_KERNEL);
> +               str = kmemdup(uc_str->uc, uc_str->len, GFP_KERNEL);
>                 if (!str) {
>                         ret = -ENOMEM;
>                         goto out;
> --
> 2.34.1