From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jarkko Sakkinen Date: Wed, 22 Mar 2017 11:42:56 +0000 Subject: Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error Message-Id: <20170322114256.pdwg6buj2wkhcooy@intel.com> List-Id: References: <20170320142336.10997-1-colin.king@canonical.com> In-Reply-To: <20170320142336.10997-1-colin.king@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Colin King Cc: Peter Huewe , Marcel Selhorst , Jason Gunthorpe , tpmdd-devel@lists.sourceforge.net, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > From: Colin Ian King > > The comparison of an out of range index into space->context_tbl is > off-by-one and should be using >= rather than > in the comparison. > > Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > > Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > Signed-off-by: Colin Ian King > --- > drivers/char/tpm/tpm2-space.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > index d36d81e07076..009934269514 100644 > --- a/drivers/char/tpm/tpm2-space.c > +++ b/drivers/char/tpm/tpm2-space.c > @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > int i; > > i = 0xFFFFFF - (vhandle & 0xFFFFFF); > - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > return false; > > phandle = space->context_tbl[i]; > -- > 2.11.0 Thanks. If you don't mind, I would squash this to that patch? /Jarkko From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jarkko Sakkinen Subject: Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error Date: Wed, 22 Mar 2017 13:42:56 +0200 Message-ID: <20170322114256.pdwg6buj2wkhcooy@intel.com> References: <20170320142336.10997-1-colin.king@canonical.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Content-Disposition: inline In-Reply-To: <20170320142336.10997-1-colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: tpmdd-devel-bounces-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org To: Colin King Cc: kernel-janitors-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, linux-kernel-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org List-Id: tpmdd-devel@lists.sourceforge.net On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > From: Colin Ian King > > The comparison of an out of range index into space->context_tbl is > off-by-one and should be using >= rather than > in the comparison. > > Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > > Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > Signed-off-by: Colin Ian King > --- > drivers/char/tpm/tpm2-space.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > index d36d81e07076..009934269514 100644 > --- a/drivers/char/tpm/tpm2-space.c > +++ b/drivers/char/tpm/tpm2-space.c > @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > int i; > > i = 0xFFFFFF - (vhandle & 0xFFFFFF); > - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > return false; > > phandle = space->context_tbl[i]; > -- > 2.11.0 Thanks. If you don't mind, I would squash this to that patch? /Jarkko ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934147AbdCVLqN (ORCPT ); Wed, 22 Mar 2017 07:46:13 -0400 Received: from mga03.intel.com ([134.134.136.65]:5346 "EHLO mga03.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1758943AbdCVLqF (ORCPT ); Wed, 22 Mar 2017 07:46:05 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,205,1486454400"; d="scan'208";a="79365501" Date: Wed, 22 Mar 2017 13:42:56 +0200 From: Jarkko Sakkinen To: Colin King Cc: Peter Huewe , Marcel Selhorst , Jason Gunthorpe , tpmdd-devel@lists.sourceforge.net, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error Message-ID: <20170322114256.pdwg6buj2wkhcooy@intel.com> References: <20170320142336.10997-1-colin.king@canonical.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170320142336.10997-1-colin.king@canonical.com> Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo User-Agent: Mutt/1.6.2-neo (2016-08-21) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > From: Colin Ian King > > The comparison of an out of range index into space->context_tbl is > off-by-one and should be using >= rather than > in the comparison. > > Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > > Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > Signed-off-by: Colin Ian King > --- > drivers/char/tpm/tpm2-space.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > index d36d81e07076..009934269514 100644 > --- a/drivers/char/tpm/tpm2-space.c > +++ b/drivers/char/tpm/tpm2-space.c > @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > int i; > > i = 0xFFFFFF - (vhandle & 0xFFFFFF); > - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > return false; > > phandle = space->context_tbl[i]; > -- > 2.11.0 Thanks. If you don't mind, I would squash this to that patch? /Jarkko