Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2217504/?format=api
{ "id": 2217504, "url": "http://patchwork.ozlabs.org/api/patches/2217504/?format=api", "web_url": "http://patchwork.ozlabs.org/project/uboot/patch/20260329231151.332108-1-marek.vasut+renesas@mailbox.org/", "project": { "id": 18, "url": "http://patchwork.ozlabs.org/api/projects/18/?format=api", "name": "U-Boot", "link_name": "uboot", "list_id": "u-boot.lists.denx.de", "list_email": "u-boot@lists.denx.de", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260329231151.332108-1-marek.vasut+renesas@mailbox.org>", "list_archive_url": null, "date": "2026-03-29T23:11:36", "name": "ufs: core: Fix heap corruption due to out of bounds write", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "4e37370274be4a35c15af91fd86c1ca3eba18f7c", "submitter": { "id": 85650, "url": "http://patchwork.ozlabs.org/api/people/85650/?format=api", "name": "Marek Vasut", "email": "marek.vasut+renesas@mailbox.org" }, "delegate": { "id": 84350, "url": "http://patchwork.ozlabs.org/api/users/84350/?format=api", "username": "narmstrong", "first_name": "Neil", "last_name": "Armstrong", "email": "narmstrong@baylibre.com" }, "mbox": "http://patchwork.ozlabs.org/project/uboot/patch/20260329231151.332108-1-marek.vasut+renesas@mailbox.org/mbox/", "series": [ { "id": 497939, "url": "http://patchwork.ozlabs.org/api/series/497939/?format=api", "web_url": "http://patchwork.ozlabs.org/project/uboot/list/?series=497939", "date": "2026-03-29T23:11:36", "name": "ufs: core: Fix heap corruption due to out of bounds write", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/497939/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2217504/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2217504/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<u-boot-bounces@lists.denx.de>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n secure) header.d=mailbox.org header.i=@mailbox.org header.a=rsa-sha256\n header.s=mail20150812 header.b=XNWN/7P3;\n\tdkim=pass (2048-bit key) header.d=mailbox.org header.i=@mailbox.org\n header.a=rsa-sha256 header.s=mail20150812 header.b=qGGd7Dbu;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=lists.denx.de\n (client-ip=85.214.62.61; helo=phobos.denx.de;\n envelope-from=u-boot-bounces@lists.denx.de; receiver=patchwork.ozlabs.org)", "phobos.denx.de;\n dmarc=pass (p=reject dis=none) header.from=mailbox.org", "phobos.denx.de;\n spf=pass smtp.mailfrom=u-boot-bounces@lists.denx.de", "phobos.denx.de;\n\tdkim=pass (2048-bit key;\n secure) header.d=mailbox.org header.i=@mailbox.org header.b=\"XNWN/7P3\";\n\tdkim=pass (2048-bit key) header.d=mailbox.org header.i=@mailbox.org\n header.b=\"qGGd7Dbu\";\n\tdkim-atps=neutral", "phobos.denx.de;\n dmarc=pass (p=reject dis=none) header.from=mailbox.org", "phobos.denx.de;\n spf=pass smtp.mailfrom=marek.vasut+renesas@mailbox.org", "outgoing_mbo_mout;\n dkim=pass header.d=mailbox.org header.s=mail20150812 header.b=qGGd7Dbu;\n spf=pass (outgoing_mbo_mout: domain of marek.vasut+renesas@mailbox.org\n designates 2001:67c:2050:b231:465::2 as permitted sender)\n smtp.mailfrom=marek.vasut+renesas@mailbox.org" ], "Received": [ "from phobos.denx.de (phobos.denx.de [85.214.62.61])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fkVWp09FHz1xtJ\n\tfor <incoming@patchwork.ozlabs.org>; Mon, 30 Mar 2026 10:12:06 +1100 (AEDT)", "from h2850616.stratoserver.net (localhost [IPv6:::1])\n\tby phobos.denx.de (Postfix) with ESMTP id BBDB383B48;\n\tMon, 30 Mar 2026 01:12:03 +0200 (CEST)", "by phobos.denx.de (Postfix, from userid 109)\n id 5FFDD83CD3; Mon, 30 Mar 2026 01:12:01 +0200 (CEST)", "from mout-p-102.mailbox.org (mout-p-102.mailbox.org [80.241.56.152])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits))\n (No client certificate requested)\n by phobos.denx.de (Postfix) with ESMTPS id 62B328063E\n for <u-boot@lists.denx.de>; Mon, 30 Mar 2026 01:11:58 +0200 (CEST)", "from smtp2.mailbox.org (smtp2.mailbox.org\n [IPv6:2001:67c:2050:b231:465::2])\n (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest\n SHA256)\n (No client certificate requested)\n by mout-p-102.mailbox.org (Postfix) with ESMTPS id 4fkVWd0xPYz9t3C;\n Mon, 30 Mar 2026 01:11:57 +0200 (CEST)" ], "X-Spam-Checker-Version": "SpamAssassin 3.4.2 (2018-09-13) on phobos.denx.de", "X-Spam-Level": "", "X-Spam-Status": "No, score=-0.1 required=5.0 tests=BAYES_00,DKIM_SIGNED,\n DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_BLOCKED,\n RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED,\n SPF_HELO_PASS,SPF_PASS autolearn=no autolearn_force=no version=3.4.2", "DKIM-Signature": [ "v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailbox.org;\n s=mail20150812; t=1774825917;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:\n content-transfer-encoding:content-transfer-encoding;\n bh=xZEtDe0D6pLuEaTwEGISxJYnmxVTcjtpGFJZt8c9I2U=;\n b=XNWN/7P3dAg2bQqQYTPuKGACl7iU0vDvhdFSEhFea2ndZYQX+d9keN9oxT5fDSWMHT4IWf\n bcqoqJzK2Sa7nRpAko7fg1WNIP4R1JCrPsM6Ekn8KP7h4wRsZ/ICR0/zH4aQJ6CIUHUF17\n UH815hKwP/z1wjmMk+cFmWwijPLU/hYsA0tKVkY+Q7OzIVc9eTa4U9FuwwBWZa0f0d91UE\n ATEbCcsmV/DmjM8B9R0XWTJW3YA/jgXmFrdGV4q9wghzDKHrAgw2MYVdwcX8b9Vfznmf7x\n hXCih7U/s4hgrijejyIIUQ4nQyT51xDwUzYJ1iHKgUTwMdUQrfOscak5PNjjMA==", "v=1; a=rsa-sha256; c=relaxed/relaxed; d=mailbox.org;\n s=mail20150812; t=1774825915;\n h=from:from:reply-to:subject:subject:date:date:message-id:message-id:\n to:to:cc:cc:mime-version:mime-version:\n content-transfer-encoding:content-transfer-encoding;\n bh=xZEtDe0D6pLuEaTwEGISxJYnmxVTcjtpGFJZt8c9I2U=;\n b=qGGd7DbuBf4P9zMKERuZlbUAqkzA6iQXNPZXhdsIz5OH0HPdilxbtk7QvryNgyaK6YMzwz\n pYOujjRu+5q5de5md3Jk2t6yqmxehVyCUj37rzEzLkOVHNhSkSdxlqVzXdCn37xV9DE59R\n K+xyCSbB5HpH2rrRHolImcJczoaX9eOphWmXFZrNAwChzsBfD7FVUybgChKYFhjX2AZ0+k\n HgXcBOAAATo0R+77Vf1SQzMKjumhe1wLuTe3XQHEzPPYd/d3scig0ZkEDjFyJaWUNMrV5t\n Fxzvxb7DMX+iM5Q1IAn/5VJ6A406ZkytyzTpdA6K/+kzxc9m7I8HCfSs+/lVmw==" ], "From": "Marek Vasut <marek.vasut+renesas@mailbox.org>", "To": "u-boot@lists.denx.de", "Cc": "Marek Vasut <marek.vasut+renesas@mailbox.org>,\n Bhupesh Sharma <bhupesh.linux@gmail.com>,\n Julien Stephan <jstephan@baylibre.com>,\n Michal Simek <michal.simek@amd.com>,\n Neha Malcom Francis <n-francis@ti.com>,\n Neil Armstrong <neil.armstrong@linaro.org>,\n Padmarao Begari <padmarao.begari@amd.com>, Tom Rini <trini@konsulko.com>", "Subject": "[PATCH] ufs: core: Fix heap corruption due to out of bounds write", "Date": "Mon, 30 Mar 2026 01:11:36 +0200", "Message-ID": "<20260329231151.332108-1-marek.vasut+renesas@mailbox.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-MBO-RS-META": "4xggxr9dq6rri7bzbfsnmak6ozqtkidz", "X-MBO-RS-ID": "bcae9ff1b46e56d0717", "X-Rspamd-Queue-Id": "4fkVWd0xPYz9t3C", "X-BeenThere": "u-boot@lists.denx.de", "X-Mailman-Version": "2.1.39", "Precedence": "list", "List-Id": "U-Boot discussion <u-boot.lists.denx.de>", "List-Unsubscribe": "<https://lists.denx.de/options/u-boot>,\n <mailto:u-boot-request@lists.denx.de?subject=unsubscribe>", "List-Archive": "<https://lists.denx.de/pipermail/u-boot/>", "List-Post": "<mailto:u-boot@lists.denx.de>", "List-Help": "<mailto:u-boot-request@lists.denx.de?subject=help>", "List-Subscribe": "<https://lists.denx.de/listinfo/u-boot>,\n <mailto:u-boot-request@lists.denx.de?subject=subscribe>", "Errors-To": "u-boot-bounces@lists.denx.de", "Sender": "\"U-Boot\" <u-boot-bounces@lists.denx.de>", "X-Virus-Scanned": "clamav-milter 0.103.8 at phobos.denx.de", "X-Virus-Status": "Clean" }, "content": "The ufshcd_read_string_desc() can perform out of bounds write and\ncorrupt heap in case the input utf-16 string contains code points\nwhich convert to anything more than plain 7-bit ASCII string.\n\nThis occurs because utf16_to_utf8(dst, src, size) in U-Boot behaves\ndifferently than Linux utf16s_to_utf8s(..., maxlen), but the porting\nprocess did not take that into consideration. The U-Boot variant of\nthe function converts up to $size utf-16 fixed-length 16-bit input\ncharacters into as many 1..4 Byte long variable-length utf-8 output\ncharacters. That means for 16 Byte input, the output can be up to 64\nBytes long. The Linux variant converts up utf-16 input into up to\n$maxlen Bytes worth of utf-8 output, but stops at the $maxlen limit.\nThat means for 16 Byte input with maxlen=32, the processing will stop\nafter writing 32 output Bytes.\n\nIn case of U-Boot, use of utf16_to_utf8() leads to potential corruption\nof data past the $size Bytes and therefore corruption of surrounding\ncontent on the heap.\n\nThe fix is as simple, allocate buffer that is sufficient to fit the\nutf-8 string. The rest of the code in ufshcd_read_string_desc() does\ncorrectly limit the buffer to fit into the DMA descriptor afterward.\n\nSigned-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>\n---\nNOTE: This is for 2026.04, but please do test it on your hardware too.\n---\nCc: Bhupesh Sharma <bhupesh.linux@gmail.com>\nCc: Julien Stephan <jstephan@baylibre.com>\nCc: Michal Simek <michal.simek@amd.com>\nCc: Neha Malcom Francis <n-francis@ti.com>\nCc: Neil Armstrong <neil.armstrong@linaro.org>\nCc: Padmarao Begari <padmarao.begari@amd.com>\nCc: Tom Rini <trini@konsulko.com>\nCc: u-boot@lists.denx.de\n---\n drivers/ufs/ufs-uclass.c | 10 +++++++++-\n 1 file changed, 9 insertions(+), 1 deletion(-)", "diff": "diff --git a/drivers/ufs/ufs-uclass.c b/drivers/ufs/ufs-uclass.c\nindex 81fd431f951..6a51f337e47 100644\n--- a/drivers/ufs/ufs-uclass.c\n+++ b/drivers/ufs/ufs-uclass.c\n@@ -1751,7 +1751,15 @@ static int ufshcd_read_string_desc(struct ufs_hba *hba, int desc_index,\n \t\t\tgoto out;\n \t\t}\n \n-\t\tbuff_ascii = kmalloc(ascii_len, GFP_KERNEL);\n+\t\t/*\n+\t\t * utf-8 is encoded using up to 4-Bytes per character,\n+\t\t * however, we only allocate such a buffer because the\n+\t\t * utf16_to_utf8() converts the entire $ascii_len worth\n+\t\t * of input characters into up to 4-Byte long utf-8\n+\t\t * characters. The rest of the function uses only up to\n+\t\t * $ascii_len bytes of that utf-8 string.\n+\t\t */\n+\t\tbuff_ascii = kmalloc(ascii_len * 4, GFP_KERNEL);\n \t\tif (!buff_ascii) {\n \t\t\terr = -ENOMEM;\n \t\t\tgoto out;\n", "prefixes": [] }