ufs: core: Fix heap corruption due to out of bounds write

The ufshcd_read_string_desc() can perform out of bounds write and
corrupt heap in case the input utf-16 string contains code points
which convert to anything more than plain 7-bit ASCII string.

This occurs because utf16_to_utf8(dst, src, size) in U-Boot behaves
differently than Linux utf16s_to_utf8s(..., maxlen), but the porting
process did not take that into consideration. The U-Boot variant of
the function converts up to $size utf-16 fixed-length 16-bit input
characters into as many 1..4 Byte long variable-length utf-8 output
characters. That means for 16 Byte input, the output can be up to 64
Bytes long. The Linux variant converts up utf-16 input into up to
$maxlen Bytes worth of utf-8 output, but stops at the $maxlen limit.
That means for 16 Byte input with maxlen=32, the processing will stop
after writing 32 output Bytes.

In case of U-Boot, use of utf16_to_utf8() leads to potential corruption
of data past the $size Bytes and therefore corruption of surrounding
content on the heap.

The fix is as simple, allocate buffer that is sufficient to fit the
utf-8 string. The rest of the code in ufshcd_read_string_desc() does
correctly limit the buffer to fit into the DMA descriptor afterward.

Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>
Link: https://patch.msgid.link/20260329231151.332108-1-marek.vasut+renesas@mailbox.org
Signed-off-by: Neil Armstrong <neil.armstrong@linaro.org>

diff --git a/drivers/ufs/ufs-uclass.c b/drivers/ufs/ufs-uclass.c
index 81fd431f951d62ef1807f3585e5f2f03b61ef9d6..6a51f337e47eed5158e37f8e42fbe94fcf63206e 100644 (file)
--- a/drivers/ufs/ufs-uclass.c
+++ b/drivers/ufs/ufs-uclass.c
@@ -1751,7 +1751,15 @@ static int ufshcd_read_string_desc(struct ufs_hba *hba, int desc_index,
                        goto out;
                }
 
-               buff_ascii = kmalloc(ascii_len, GFP_KERNEL);
+               /*
+                * utf-8 is encoded using up to 4-Bytes per character,
+                * however, we only allocate such a buffer because the
+                * utf16_to_utf8() converts the entire $ascii_len worth
+                * of input characters into up to 4-Byte long utf-8
+                * characters. The rest of the function uses only up to
+                * $ascii_len bytes of that utf-8 string.
+                */
+               buff_ascii = kmalloc(ascii_len * 4, GFP_KERNEL);
                if (!buff_ascii) {
                        err = -ENOMEM;
                        goto out;