Re: [PATCH 1/5] scsi: ufs: core: Validate string descriptors

From: Bart Van Assche

Date: Thu Jul 16 2026 - 13:52:42 EST


On 7/15/26 11:19 PM, liqiang wrote:
@@ -3916,11 +3924,17 @@ int ufshcd_read_string_desc(struct ufs_hba *hba, u8 desc_index, u8 **buf, enum u
str[ret++] = '\0';
} else {
- str = kmemdup(uc_str->uc, uc_str->len, GFP_KERNEL);
+ /*
+ * Keep the bLength-sized raw output for the RPMB device ID ABI.
+ * The two bytes beyond the UTF-16 payload are explicitly zeroed
+ * instead of being read past the descriptor buffer.
+ */
+ str = kzalloc(uc_str->len, GFP_KERNEL);
if (!str) {
ret = -ENOMEM;
goto out;
}
+ memcpy(str, uc_str->uc, uc_len);
ret = uc_str->len;
}

The above code can be simplified by using kasprintf(GFP_KERNEL, "%.*s",
...), isn't it?

Thanks,

Bart.