From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754199AbdCWQX2 (ORCPT ); Thu, 23 Mar 2017 12:23:28 -0400 Received: from mga06.intel.com ([134.134.136.31]:29947 "EHLO mga06.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752730AbdCWQX0 (ORCPT ); Thu, 23 Mar 2017 12:23:26 -0400 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.36,210,1486454400"; d="scan'208";a="78650791" Date: Thu, 23 Mar 2017 18:23:15 +0200 From: Jarkko Sakkinen To: Dan Carpenter Cc: Colin Ian King , Peter Huewe , Marcel Selhorst , Jason Gunthorpe , tpmdd-devel@lists.sourceforge.net, kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org Subject: Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error Message-ID: <20170323162315.jadlprsu6hevm4ip@intel.com> References: <20170320142336.10997-1-colin.king@canonical.com> <20170322114256.pdwg6buj2wkhcooy@intel.com> <20170322131248.GJ32449@mwanda> <20170323155358.jpotoweghjnl4vjx@intel.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170323155358.jpotoweghjnl4vjx@intel.com> Organization: Intel Finland Oy - BIC 0357606-4 - Westendinkatu 7, 02160 Espoo User-Agent: Mutt/1.6.2-neo (2016-08-21) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, Mar 23, 2017 at 05:53:58PM +0200, Jarkko Sakkinen wrote: > On Wed, Mar 22, 2017 at 04:12:49PM +0300, Dan Carpenter wrote: > > On Wed, Mar 22, 2017 at 11:45:37AM +0000, Colin Ian King wrote: > > > On 22/03/17 11:42, Jarkko Sakkinen wrote: > > > > On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > > > >> From: Colin Ian King > > > >> > > > >> The comparison of an out of range index into space->context_tbl is > > > >> off-by-one and should be using >= rather than > in the comparison. > > > >> > > > >> Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > > > >> > > > >> Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > > > >> Signed-off-by: Colin Ian King > > > >> --- > > > >> drivers/char/tpm/tpm2-space.c | 2 +- > > > >> 1 file changed, 1 insertion(+), 1 deletion(-) > > > >> > > > >> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > > > >> index d36d81e07076..009934269514 100644 > > > >> --- a/drivers/char/tpm/tpm2-space.c > > > >> +++ b/drivers/char/tpm/tpm2-space.c > > > >> @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > > > >> int i; > > > >> > > > >> i = 0xFFFFFF - (vhandle & 0xFFFFFF); > > > >> - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > > >> + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > > >> return false; > > > >> > > > >> phandle = space->context_tbl[i]; > > > >> -- > > > >> 2.11.0 > > > > > > > > Thanks. If you don't mind, I would squash this to that patch? > > > > > > > > /Jarkko > > > > > > > Sure squash it, and maybe add a Reported-by: Colin Ian King > > > if that's OK with you. > > > > Reported-by isn't really correct though... We should have a Fixes-from: > > tag for squashed fixes. > > > > regards, > > dan carpenter > > Hmm... Maybe so depending on how you interpret Reported-by but > Fixes-from is not something that is used at the moment, is it? > > /Jarkko When I started squashing the commit I realized what you meant so I'm adding this to the commit: Fixes-from: Colin Ian King /Jarkko