Re: [PATCH v2 1/2] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Jul 24, 2026 at 08:59:02AM +0200, Vincent Mailhol wrote:
> On 24/07/2026 at 07:54, Greg KH wrote:
> > On Thu, Jul 23, 2026 at 09:40:31PM +0200, Vincent Mailhol wrote:
> >> ucs2_strnlen() checks the current character before checking whether the
> >> caller-provided maximum length has been reached. If the input is not
> >> NUL-terminated within that bound, the loop can read one ucs2_char_t past
> >> the limit.
> >>
> >> Test the length before dereferencing to prevent an off-by-one
> >> out-of-bounds read.
> > 
> > That's fine, but doing that read doesn't actually "hurt" anything,
> > right?  So this shouldn't be needed in stable kernels.  Or am I missing
> > something?
> 
> I had a similar feeling and didn't CC stable on the v1. But following
> my exchange with Andrew here:
> 
>   https://lore.kernel.org/all/CAMZ6Rq+Ax5MTs0Ke=XAB2JFX1KXuFas3B2eEMv+nQ4x7up2BLA@mail.gmail.com/
> 
> I think there *might* be some risk and finally CCed stable in v2. If
> you prefer to not backport, that's OK for me. As you can see in my
> above message, even if the risk exists, it is more theoretical and I
> don't think it would provide much leverage to turn it into a real
> exploit.

"turning into a real exploit" is not a requirement for stable backports
at all.  I was just thinking "is this even a real bug that needs to be
changed at all" given the lifetime of this issue, and the location from
where these strings come from (i.e. firmware images).

But yes, from a logical "this code should not be doing this" it does
seem correct to make.  Maybe someday we'll even be able to drop these
extra string functions entirely as we already have ways to convert from
utf16 to utf8 in the kernel already, so maybe we should just "normalize"
them all to start with after read from the firmware?

thanks,

greg k-h