Re: [PATCH 3/4] PCI/sysfs: Handle a malformed _DSM result in acpi_attr_is_visible()

Hello,

> [Severity: High]
> This isn't a bug introduced by this patch, but while reviewing how the _DSM
> buffer is handled in this file, I noticed a pre-existing issue in
> dsm_label_utf16s_to_utf8s():
> 
> drivers/pci/pci-label.c:dsm_label_utf16s_to_utf8s() {
> 	int len;
> 
> 	len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
> 			      obj->buffer.length,
> 			      UTF16_LITTLE_ENDIAN,
> 			      buf, PAGE_SIZE - 1);
> 	buf[len++] = '\n';
> 
> 	return len;
> }
> 
> Does this code pass a byte length instead of a character count?
> 
> Because utf16s_to_utf8s() expects the inlen parameter to represent the number
> of 16-bit characters, passing obj->buffer.length (which is the size in bytes)
> might instruct the function to process up to twice as many characters as are
> actually allocated for the buffer.
> 
> Could this result in an out-of-bounds heap memory read when an unprivileged
> user reads the world-readable /sys/bus/pci/devices/.../label sysfs file?

The last patch of this series aims to address this issue.

Thank you!

	Krzysztof