Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 31 Jul 2023 16:24:26 -0700
From:   Bjorn Andersson <andersson@kernel.org>
To:     Praveenkumar I <quic_ipkumar@quicinc.com>
Cc:     agross@kernel.org, konrad.dybcio@linaro.org,
        linux-arm-msm@vger.kernel.org, linux-kernel@vger.kernel.org,
        quic_varada@quicinc.com, quic_clew@quicinc.com
Subject: Re: [PATCH v2] soc: qcom: qmi_encdec: Restrict string length in
 decode
Message-ID: <educjx3enypc4r5pzjb7vopaf2df2s4kzkpqsyecoysxws5422@arrsgt6vjej2>
References: <20230731100311.2506271-1-quic_ipkumar@quicinc.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20230731100311.2506271-1-quic_ipkumar@quicinc.com>
Precedence: bulk

On Mon, Jul 31, 2023 at 03:33:11PM +0530, Praveenkumar I wrote:
> The QMI TLV value for strings in a lot of qmi element info structures
> account for null terminated strings with MAX_LEN + 1. If a string is
> actually MAX_LEN + 1 length, this will cause an out of bounds access
> when the NULL character is appended in decoding.
> 
> Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder")
> Cc: stable@vger.kernel.org
> Signed-off-by: Chris Lew <quic_clew@quicinc.com>
> Signed-off-by: Praveenkumar I <quic_ipkumar@quicinc.com>

The signed-off-by list says that Chris certified the patch's origin
first, then you took it, certified the origin and submitted it to the
mailing list.

This matches reality, but you lost Chris' authorship in the process,
please add that back.

Thanks,
Bjorn

> ---
> [v2]:
> 	Added Fixes and Cc: stable
> 
>  drivers/soc/qcom/qmi_encdec.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/soc/qcom/qmi_encdec.c b/drivers/soc/qcom/qmi_encdec.c
> index b7158e3c3a0b..5c7161b18b72 100644
> --- a/drivers/soc/qcom/qmi_encdec.c
> +++ b/drivers/soc/qcom/qmi_encdec.c
> @@ -534,8 +534,8 @@ static int qmi_decode_string_elem(const struct qmi_elem_info *ei_array,
>  		decoded_bytes += rc;
>  	}
>  
> -	if (string_len > temp_ei->elem_len) {
> -		pr_err("%s: String len %d > Max Len %d\n",
> +	if (string_len >= temp_ei->elem_len) {
> +		pr_err("%s: String len %d >= Max Len %d\n",
>  		       __func__, string_len, temp_ei->elem_len);
>  		return -ETOOSMALL;
>  	} else if (string_len > tlv_len) {
> -- 
> 2.34.1
>