Re: [PATCH 1/4] PCI/sysfs: Stop reporting _DSM failures as -EPERM

["Krzysztof Wilczyński" <kwilczynski@kernel.org>]

Hello,

> [Severity: High]
> This isn't a bug introduced by this patch, but does this code cause a buffer
> over-read?
> 
> It appears utf16s_to_utf8s() expects the maximum number of 16-bit characters
> as its second argument, but it is being passed obj->buffer.length in bytes.
> 
> If a PCI device with a firmware-provided ACPI _DSM returns a
> non-NUL-terminated buffer of UTF-16 characters, could this read past the end
> of the allocation when a user reads the world-readable sysfs label attribute?
> 
> Should the length be divided by sizeof(wchar_t) to prevent reading out of
> bounds?

The last patch of this series aims to address this issue.

Thank you!

	Krzysztof