| Message ID | 20210603000112.703037-7-kw@linux.com (mailing list archive) |
|---|---|
| State | Superseded |
| Delegated to: | Bjorn Helgaas |
| Headers | show |
| Series | PCI/sysfs: Use sysfs_emit() and sysfs_emit_at() in "show" functions | expand |
diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c index 000e169c7197..0c6446519640 100644 --- a/drivers/pci/pci-label.c +++ b/drivers/pci/pci-label.c @@ -146,8 +146,8 @@ static int dsm_label_utf16s_to_utf8s(union acpi_object *obj, char *buf) len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer, obj->buffer.length, UTF16_LITTLE_ENDIAN, - buf, PAGE_SIZE); - buf[len] = '\n'; + buf, PAGE_SIZE - 1); + buf[len++] = '\n'; return len; }
When using ACPI to retrieve a device label from _DSM using the dsm_get_label() function the result can be retrieved either as a string value or a pointer to a buffer. Should it be the latter, then an additional function called dsm_label_utf16s_to_utf8s() will be invoked to convert any UTF16 characters to UTF8 so that the value could be safely stored and later displayed through a relevant sysfs object. Internally, dsm_label_utf16s_to_utf8s() calls the utf16s_to_utf8s() function to handle the conversion setting the limit of the data that can be saved into a provided buffer as a result of the character conversion to be a total of PAGE_SIZE. The utf16s_to_utf8s() function returns an integer value denoting the number of bytes that have been written into the provided buffer. Following the execution of the utf16s_to_utf8s() a newline character will be added at the end of the resulting buffer so that when the value is read in the userspace through the sysfs object then it would include newline making it more accessible when working with the sysfs file system in the shell, etc. Normally, this wouldn't be a problem, but if the function utf16s_to_utf8s() happens to return the number of bytes written to be precisely PAGE_SIZE, then we would overrun the buffer and write the newline character outside the allotted space which can have undefined consequences or result in a failure. To fix this buffer overrun, ensure that there always is enough space left for the newline character to be safely appended. Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs") Reported-by: Joe Perches <joe@perches.com> Signed-off-by: Krzysztof Wilczyński <kw@linux.com> --- drivers/pci/pci-label.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-)