Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <b1049e10-95ee-7342-56ec-f0dc683f4759@quicinc.com>
Date:   Tue, 1 Aug 2023 12:11:58 +0530
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:102.0) Gecko/20100101
 Thunderbird/102.13.0
Subject: Re: [PATCH v2] soc: qcom: qmi_encdec: Restrict string length in
 decode
Content-Language: en-US
To:     Bjorn Andersson <andersson@kernel.org>
CC:     <agross@kernel.org>, <konrad.dybcio@linaro.org>,
        <linux-arm-msm@vger.kernel.org>, <linux-kernel@vger.kernel.org>,
        <quic_varada@quicinc.com>, <quic_clew@quicinc.com>
References: <20230731100311.2506271-1-quic_ipkumar@quicinc.com>
 <educjx3enypc4r5pzjb7vopaf2df2s4kzkpqsyecoysxws5422@arrsgt6vjej2>
From:   Praveenkumar I <quic_ipkumar@quicinc.com>
In-Reply-To: <educjx3enypc4r5pzjb7vopaf2df2s4kzkpqsyecoysxws5422@arrsgt6vjej2>
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk


On 8/1/2023 4:54 AM, Bjorn Andersson wrote:
> On Mon, Jul 31, 2023 at 03:33:11PM +0530, Praveenkumar I wrote:
>> The QMI TLV value for strings in a lot of qmi element info structures
>> account for null terminated strings with MAX_LEN + 1. If a string is
>> actually MAX_LEN + 1 length, this will cause an out of bounds access
>> when the NULL character is appended in decoding.
>>
>> Fixes: 9b8a11e82615 ("soc: qcom: Introduce QMI encoder/decoder")
>> Cc: stable@vger.kernel.org
>> Signed-off-by: Chris Lew <quic_clew@quicinc.com>
>> Signed-off-by: Praveenkumar I <quic_ipkumar@quicinc.com>
> The signed-off-by list says that Chris certified the patch's origin
> first, then you took it, certified the origin and submitted it to the
> mailing list.
>
> This matches reality, but you lost Chris' authorship in the process,
> please add that back.
Yes, you are right. Will add that, and post it.

- Praveenkumar
> Thanks,
> Bjorn
>
>> ---
>> [v2]:
>> 	Added Fixes and Cc: stable
>>
>>   drivers/soc/qcom/qmi_encdec.c | 4 ++--
>>   1 file changed, 2 insertions(+), 2 deletions(-)
>>
>> diff --git a/drivers/soc/qcom/qmi_encdec.c b/drivers/soc/qcom/qmi_encdec.c
>> index b7158e3c3a0b..5c7161b18b72 100644
>> --- a/drivers/soc/qcom/qmi_encdec.c
>> +++ b/drivers/soc/qcom/qmi_encdec.c
>> @@ -534,8 +534,8 @@ static int qmi_decode_string_elem(const struct qmi_elem_info *ei_array,
>>   		decoded_bytes += rc;
>>   	}
>>   
>> -	if (string_len > temp_ei->elem_len) {
>> -		pr_err("%s: String len %d > Max Len %d\n",
>> +	if (string_len >= temp_ei->elem_len) {
>> +		pr_err("%s: String len %d >= Max Len %d\n",
>>   		       __func__, string_len, temp_ei->elem_len);
>>   		return -ETOOSMALL;
>>   	} else if (string_len > tlv_len) {
>> -- 
>> 2.34.1
>>