Re: [PATCH v2 1/2] lib/ucs2_string.c: fix out-of-bounds read in ucs2_strnlen()

[Vincent Mailhol]

On 24/07/2026 at 07:54, Greg KH wrote:
> On Thu, Jul 23, 2026 at 09:40:31PM +0200, Vincent Mailhol wrote:
>> ucs2_strnlen() checks the current character before checking whether the
>> caller-provided maximum length has been reached. If the input is not
>> NUL-terminated within that bound, the loop can read one ucs2_char_t past
>> the limit.
>>
>> Test the length before dereferencing to prevent an off-by-one
>> out-of-bounds read.
> 
> That's fine, but doing that read doesn't actually "hurt" anything,
> right?  So this shouldn't be needed in stable kernels.  Or am I missing
> something?

I had a similar feeling and didn't CC stable on the v1. But following
my exchange with Andrew here:

  https://lore.kernel.org/all/CAMZ6Rq+Ax5MTs0Ke=XAB2JFX1KXuFas3B2eEMv+nQ4x7up2BLA@xxxxxxxxxxxxxx/

I think there *might* be some risk and finally CCed stable in v2. If
you prefer to not backport, that's OK for me. As you can see in my
above message, even if the risk exists, it is more theoretical and I
don't think it would provide much leverage to turn it into a real
exploit.


Yours sincerely,
Vincent Mailhol