Re: [PATCH 1/4] PCI/sysfs: Stop reporting _DSM failures as -EPERM

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] Buffer over-read in dsm_label_utf16s_to_utf8s() due to passing length in bytes instead of 16-bit characters.
--

--- Patch [1]: [PATCH 1/4] PCI/sysfs: Stop reporting _DSM failures as -EPERM ---
commit cd414532673d45c83fe3ca965ef9476bab4c3514
Author: Krzysztof Wilczyński <[email protected]>

    PCI/sysfs: Stop reporting _DSM failures as -EPERM

This patch updates dsm_get_label() to return appropriate error codes (-ENODEV
and -EIO) instead of the literal -1. This resolves incorrect -EPERM errors in
sysfs reads when ACPI companions are missing or _DSM evaluations fail.

Link: https://github.com/pciutils/pciutils/issues/175

> diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
> index 0c64465196404..255e0ecffb096 100644
> --- a/drivers/pci/pci-label.c
> +++ b/drivers/pci/pci-label.c
> @@ -160,12 +160,12 @@ static int dsm_get_label(struct device *dev, char *buf,
>  	int len = 0;
>  
>  	if (!handle)
> -		return -1;
> +		return -ENODEV;

[ ... ]

While reviewing this patch, I noticed a pre-existing issue in the same file:

drivers/pci/pci-label.c:dsm_label_utf16s_to_utf8s() {
    ...
	len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
			      obj->buffer.length,
			      UTF16_LITTLE_ENDIAN,
			      buf, PAGE_SIZE - 1);
    ...
}

[Severity: High]
This isn't a bug introduced by this patch, but does this code cause a buffer
over-read?

It appears utf16s_to_utf8s() expects the maximum number of 16-bit characters
as its second argument, but it is being passed obj->buffer.length in bytes.

If a PCI device with a firmware-provided ACPI _DSM returns a
non-NUL-terminated buffer of UTF-16 characters, could this read past the end
of the allocation when a user reads the world-readable sysfs label attribute?

Should the length be divided by sizeof(wchar_t) to prevent reading out of
bounds?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1