Re: [PATCH v2 04/10] lib/ucs2_string: Split out ucs2_as_utf8_l() taking a separate limit

[Vincent Mailhol <mailhol@kernel.org>]

On 09/09/2026 at 13:55, Ard Biesheuvel wrote:
> From: Ard Biesheuvel <ardb@kernel.org>
> 
> ucs2_as_utf() takes a maxlength argument, which specifies how many bytes
  ^^^^^^^^^^^^^
Typo: ucs2_as_utf8() (missing '8').

> the function is permitted to store into the destination buffer.
> 
> The same value is used as an upper bound for the ucs2_strnlen()
> invocation, which is reasonable in the general case, as each UCS-2
> character produces at least one byte of UTF-8 output, and so there is
> never a need to process more than 'maxlength' UCS-2 characters.
> 
> However, if the UCS-2 string is not NUL terminated, ucs2_strnlen() may
> read past the end of the buffer if 'maxlength' is set to a high value.
> 
> Current callers pass UCS-2 strings that are expected to be NUL
> terminated, but for processing the load options in the EFI stub, a
> version is needed that takes a separate limit argument. So split that
> off from the current implementation.
> 
> Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
> ---
>  include/linux/ucs2_string.h | 11 ++++++++++-
>  lib/ucs2_string.c           |  6 +++---
>  2 files changed, 13 insertions(+), 4 deletions(-)
> 
> diff --git a/include/linux/ucs2_string.h b/include/linux/ucs2_string.h
> index c499ae809c7d..74f23ca5a967 100644
> --- a/include/linux/ucs2_string.h
> +++ b/include/linux/ucs2_string.h
> @@ -14,7 +14,16 @@ ssize_t ucs2_strscpy(ucs2_char_t *dst, const ucs2_char_t *src, size_t count);
>  int ucs2_strncmp(const ucs2_char_t *a, const ucs2_char_t *b, size_t len);
>  
>  unsigned long ucs2_utf8size(const ucs2_char_t *src);
> +unsigned long
> +ucs2_as_utf8_l(u8 *dest, const ucs2_char_t *src, unsigned long limit,
> +	       unsigned long maxlength);
> +
> +static inline
>  unsigned long ucs2_as_utf8(u8 *dest, const ucs2_char_t *src,
> -			   unsigned long maxlength);
> +			   unsigned long maxlength)
> +{
> +	return ucs2_as_utf8_l(dest, src, ucs2_strnlen(src, maxlength),
> +			      maxlength);
> +}
>  
>  #endif /* _LINUX_UCS2_STRING_H_ */
> diff --git a/lib/ucs2_string.c b/lib/ucs2_string.c
> index f75fb4f7961a..2df9bef79eea 100644
> --- a/lib/ucs2_string.c
> +++ b/lib/ucs2_string.c
> @@ -132,11 +132,11 @@ EXPORT_SYMBOL(ucs2_utf8size);
>   * final NUL character.
>   */

ucs2_as_utf8_l() still uses the old documentation of ucs2_as_utf8().
It currently reads:

  /*
   * copy at most maxlength bytes of whole utf8 characters to dest from the
   * ucs2 string src.
   *
   * The return value is the number of characters copied, not including the
   * final NUL character.
   */

That documentation should probably be moved to linux/ucs2_string.h so
that ucs2_as_utf8() remains documented after being turned into a
static inline wrapper.

As for ucs2_as_utf8_l(), it would be worth adding a new comment block
to highlight its specific behaviour: the new limit argument, the fact
that the string is only NUL-terminated if there is enough space and
that the return value is not the number of wide characters copied but
the number of bytes copied.

>  unsigned long
> -ucs2_as_utf8(u8 *dest, const ucs2_char_t *src, unsigned long maxlength)
> +ucs2_as_utf8_l(u8 *dest, const ucs2_char_t *src, unsigned long limit,
> +	       unsigned long maxlength)
>  {
>  	unsigned int i;
>  	unsigned long j = 0;
> -	unsigned long limit = ucs2_strnlen(src, maxlength);
>  
>  	for (i = 0; maxlength && i < limit; i++) {
>  		u16 c = src[i];
> @@ -163,7 +163,7 @@ ucs2_as_utf8(u8 *dest, const ucs2_char_t *src, unsigned long maxlength)
>  		dest[j] = '\0';
>  	return j;
>  }
> -EXPORT_SYMBOL(ucs2_as_utf8);
> +EXPORT_SYMBOL(ucs2_as_utf8_l);
>  
>  #ifndef __DISABLE_EXPORTS
>  MODULE_DESCRIPTION("UCS2 string handling");


Yours sincerely,
Vincent Mailhol