From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E554881F for ; Fri, 10 Mar 2023 14:47:33 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 91F06C433A4; Fri, 10 Mar 2023 14:47:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1678459653; bh=UoUFJTmAqnc6MvlcB91plmS3/8Xwduunj3MqJsbNRnM=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=xfY7N21sIKGALlcvv3At9syDXPKE032qwwvYrm1byLyuWkOWnZv8QwvsaZ6QZ4vvE C3nIz6w4gv5bjeUZsiWcvCx47YyBcRn4TYWR3OWNKXraN2eE/vdd6hywegeKhCrFyg fvNFcEDJ1qtEQ4+K84g2hP8RkJc+RtS3E2+r/2/c= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Roberto Sassu , Herbert Xu , Eric Biggers , Sasha Levin Subject: [PATCH 5.10 075/529] lib/mpi: Fix buffer overrun when SG is too long Date: Fri, 10 Mar 2023 14:33:38 +0100 Message-Id: <20230310133808.446913598@linuxfoundation.org> X-Mailer: git-send-email 2.39.2 In-Reply-To: <20230310133804.978589368@linuxfoundation.org> References: <20230310133804.978589368@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Herbert Xu [ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ] The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes. Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") Reported-by: Roberto Sassu Signed-off-by: Herbert Xu Reviewed-by: Eric Biggers Signed-off-by: Herbert Xu Signed-off-by: Sasha Levin --- lib/mpi/mpicoder.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c index 7ea225b2204fa..7054311d78792 100644 --- a/lib/mpi/mpicoder.c +++ b/lib/mpi/mpicoder.c @@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes) while (sg_miter_next(&miter)) { buff = miter.addr; - len = miter.length; + len = min_t(unsigned, miter.length, nbytes); + nbytes -= len; for (x = 0; x < len; x++) { a <<= 8; -- 2.39.2