lkml.org 
[lkml]   [2023]   [Aug]   [1]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH v2] soc: qcom: qmi_encdec: Restrict string length in decode
From

On 8/1/2023 4:54 AM, Bjorn Andersson wrote:
> On Mon, Jul 31, 2023 at 03:33:11PM +0530, Praveenkumar I wrote:
>> The QMI TLV value for strings in a lot of qmi element info structures
>> account for null terminated strings with MAX_LEN + 1. If a string is
>> actually MAX_LEN + 1 length, this will cause an out of bounds access
>> when the NULL character is appended in decoding.
>>
>> Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Chris Lew <quic_clew@quicinc.com>
>> Signed-off-by: Praveenkumar I <quic_ipkumar@quicinc.com>
> The signed-off-by list says that Chris certified the patch's origin
> first, then you took it, certified the origin and submitted it to the
> mailing list.
>
> This matches reality, but you lost Chris' authorship in the process,
> please add that back.
Yes, you are right. Will add that, and post it.

- Praveenkumar
> Thanks,
> Bjorn
>
>> ---
>> [v2]:
>> Added Fixes and Cc: stable
>>
>> drivers/soc/qcom/qmi_encdec.c | 4 ++--
>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/soc/qcom/qmi_encdec.c b/drivers/soc/qcom/qmi_encdec.c
>> index b7158e3c3a0b..5c7161b18b72 100644
>> --- a/drivers/soc/qcom/qmi_encdec.c
>> +++ b/drivers/soc/qcom/qmi_encdec.c
>> @@ -534,8 +534,8 @@ static int qmi_decode_string_elem(const struct qmi_elem_info *ei_array,
>> decoded_bytes += rc;
>> }
>>
>> - if (string_len > temp_ei->elem_len) {
>> - pr_err("%s: String len %d > Max Len %d\n",
>> + if (string_len >= temp_ei->elem_len) {
>> + pr_err("%s: String len %d >= Max Len %d\n",
>> __func__, string_len, temp_ei->elem_len);
>> return -ETOOSMALL;
>> } else if (string_len > tlv_len) {
>> --
>> 2.34.1
>>

\
 
 \ /
  Last update: 2023-08-01 08:43    [W:0.055 / U:1.192 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site