Re: [PATCH 2/2] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

[Andrew Morton]

On Wed, 22 Jul 2026 23:04:53 +0200 Vincent Mailhol <mailhol@xxxxxxxxxx> wrote:

> ucs2_strnlen() checks the current character before checking whether the
> caller-provided maximum length has been reached. If the input is not
> NUL-terminated within that bound, the loop can read one ucs2_char_t past
> the limit.

Is there a known way of hitting this from userspace?  If so, and if the
effect is at all serious then we should prepare a backportable fix
against current mainline - that whitespace tweaking patch can come
later.

Also, AI review points at a few possible pre-existing problems in there
which might interest you:
	https://sashiko.dev/#/patchset/20260722-fix-ucs2_strnlen-v1-0-ba5bade2b026@xxxxxxxxxx

Thanks.