Re: [PATCH 3/4] PCI/sysfs: Handle a malformed _DSM result in acpi_attr_is_visible()

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:

Pre-existing issues:
- [High] The function `dsm_label_utf16s_to_utf8s` passes the byte length of an ACPI buffer as the `inlen` parameter to `utf16s_to_utf8s`, which expects the length in `wchar_t` elements, leading to an out-of-bounds read.
--

--- Patch [3]: [PATCH 3/4] PCI/sysfs: Handle a malformed _DSM result in acpi_attr_is_visible() ---
commit 1e24bdb9829d783f4fae2c39ec3d3567d6ea73df
Author: Krzysztof Wilczyński <kwilczynski@kernel.org>

PCI/sysfs: Handle a malformed _DSM result in acpi_attr_is_visible()

This commit updates acpi_attr_is_visible() to evaluate the Device Name
_DSM when deciding attribute visibility. This ensures each attribute is
only created when the exported element has a type that the read path
accepts, preventing failing reads for malformed objects.

Closes: https://github.com/pciutils/pciutils/issues/175

> diff --git a/drivers/pci/pci-label.c b/drivers/pci/pci-label.c
> index 5b08f50653a37..abb941530c560 100644
> --- a/drivers/pci/pci-label.c
> +++ b/drivers/pci/pci-label.c

[ ... ]

[Severity: High]
This isn't a bug introduced by this patch, but while reviewing how the _DSM
buffer is handled in this file, I noticed a pre-existing issue in
dsm_label_utf16s_to_utf8s():

drivers/pci/pci-label.c:dsm_label_utf16s_to_utf8s() {
	int len;

	len = utf16s_to_utf8s((const wchar_t *)obj->buffer.pointer,
			      obj->buffer.length,
			      UTF16_LITTLE_ENDIAN,
			      buf, PAGE_SIZE - 1);
	buf[len++] = '\n';

	return len;
}

Does this code pass a byte length instead of a character count?

Because utf16s_to_utf8s() expects the inlen parameter to represent the number
of 16-bit characters, passing obj->buffer.length (which is the size in bytes)
might instruct the function to process up to twice as many characters as are
actually allocated for the buffer.

Could this result in an out-of-bounds heap memory read when an unprivileged
user reads the world-readable /sys/bus/pci/devices/.../label sysfs file?

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260814070522.2327975-1-kwilczynski@kernel.org?part=3