From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f50.google.com (mail-qv1-f50.google.com [209.85.219.50]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id F3EBE1DDC2B for ; Sun, 8 Mar 2026 20:17:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.50 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773001078; cv=none; b=aN2svoMG9i5+9CAAMhSWhXg8cnq0CCm92DYoU5SYnjcTa5blbY0W6OKAT2OPCk3UuBFJQnKQux/MZGuZJVqzus21wzavJnmcsqNLhXUWu92MF6tdAl45HLgWuiW9SwQodual6q2bjwKnbU0LoA3Lx/ZI5GCD8sznSVxpkXD6tSY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773001078; c=relaxed/simple; bh=Do3lvraRPJPfDUjPEndZYl8TZWWV/c+QIpilV61DBt0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=C1sf7sfzEdFEQd6mYdLLl5im8+XkH3lNZnO6REqgh30ltQZ9InhUZjhG1fwhN9xz+bfZB3EZzWEEa3S+5qxY0U5QAvL5uXfiEll3sMjDiC80qkXMO1/vCYHi/1fsbB8jFq2hdKw6lIbb9aJ/uOfV2kdfNgcBaL/AH08SvatCigM= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=fGt8qX4l; arc=none smtp.client-ip=209.85.219.50 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="fGt8qX4l" Received: by mail-qv1-f50.google.com with SMTP id 6a1803df08f44-89a05955720so98607196d6.2 for ; Sun, 08 Mar 2026 13:17:56 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773001076; x=1773605876; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=bxs7TzLvMhb5FxtEzmIDewlCdxuIuN9fasqFJP3wBfY=; b=fGt8qX4lqIZYu1F3FR2ZfOJXh9VKhyMgb2RRnZ+FuQ3ErrYrBhFP2LMv1t93PvZ1gh NrhWKvqWzVsgcNiV9VzXcsbSxmuDrLLRv8xzxtBr1cemc0B4bV4myLrl1R9iTBmUgsuJ Wyqx+n4s3JFYpzuel7NoDO3VC85CU0Xg7xWXLLHwEBFnGRn8sh4kJLLW/4QXBbfD1qAH dBNLOuFRfc+/8ffVK7WYUpdQ3gKegzoFMj3mtW3GWobgZ4MFISBhMyzd2njE5W9S7EDB yElPhSTr12+iUR1yZE56nef00vLE15+XVUtrPlK0epXIeiCYhDTU/q4rt3T8cvQSoYop M05g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773001076; x=1773605876; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=bxs7TzLvMhb5FxtEzmIDewlCdxuIuN9fasqFJP3wBfY=; b=YwI89SqZObFXKmaV0DNqfv+He1j4D3hHuqniG6xdyoskZQegxxgak2QeH77vd7BPHt jGY9pyZtjCwO9Vfy4W+e4r8f349G5pKZfprhFAdkdzTCLQcwIQayN1mMIZQ4tWTlPAIM YP2gx88UmWJQ9srUq98zAf2djXaPDywdJ5eq4kgrVSKcJVNM8nfMYsOupbm1vDmVfoqO ntUQTFff4kqxLz/aIglPti1n5oHdgShArlBu14I+lPmalPbnbNxmxWUCFUiuWhufcQ4E UcWWPbTBjSRuepDj9HbiaJ7JEF9BJxWO8AcCBbQ/BvIuy8rTrY7MeNxjrTCcmZoE0kb4 QW/A== X-Gm-Message-State: AOJu0Yz4rsa614J8d09Mg+spq+uHmtlLng/NMIAHAnjIw71rr+2BPG9r cuwYIJoYAXRmbxjn9+zGKv2Dg12ywnTEF0D4tiRJDbHkclPStxSP75WoE7+USI2S/b8= X-Gm-Gg: ATEYQzw+a90btoNwQHsQGX8PL1s+G4GeVfgUSQGSFP/mB3Sjx08eFIBYGtAknP4zIz1 tw50x0+VpCSd79HlNwJTrLciomt12dn7cgWuK6ynrHvNJWfFYWWoNVZmKQf7FZ/n3StLSBmkWcK Kg1pyesQAGRB/EKcuNAE3XaOVufHdtVzYkvDQgSOZJCyugH1+CuQToqmXwIgvevMA82yNFZnbdf uH9REWnZr4AqvUvFl+pcYgJ7Qq2vm190VdNZ3cWUgkpgtqxHEmdVHpNQrPp9FIQK7MlARL+9EOc qtSZayJC4U69JLk+/xKf1PoGFPXi4AHL5I04svvwKF/xJWKasj/uYfjQ9BWwiDQRKA8qAKvmMlm oqmmifBu9SBO1ehxm6elEiR9HsaFR3i0r6sj/5FO9wLABBvl7wCqSj3Z1LSkPvZ0drcDkmYQnBb bbjlGlPCWGRm2VNU2Ef9j6BcHoyXkOfZ6lamvyQLkid5nZb9/ll/rRYL/jkDMDncorqNp4tdeYn +QL X-Received: by 2002:ad4:5cae:0:b0:899:fb4e:47a0 with SMTP id 6a1803df08f44-89a30b016ebmr142007116d6.60.1773001075779; Sun, 08 Mar 2026 13:17:55 -0700 (PDT) Received: from instance-20260207-1316.vcn12250046.oraclevcn.com ([150.136.248.187]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-89a316eca85sm58264186d6.41.2026.03.08.13.17.54 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Mar 2026 13:17:55 -0700 (PDT) From: Josh Law X-Google-Original-From: Josh Law To: Andrew Morton Cc: linux-kernel@vger.kernel.org, Josh Law Subject: [PATCH v3 1/2] lib/ts_bm: fix integer overflow in pattern length calculation Date: Sun, 8 Mar 2026 20:17:52 +0000 Message-ID: <20260308201753.2889216-1-objecting@objecting.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260308125519.dc842722209726977a8e14cc@linux-foundation.org> References: <20260308125519.dc842722209726977a8e14cc@linux-foundation.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Josh Law Changes in v3: - move overflow checks before the arithmetic they guard - add comments explaining the zero-length and size-overflow cases - use check_mul_overflow() and check_add_overflow() from overflow.h The ts_bm algorithm stores its good_shift[] table and pattern in a single allocation sized from the pattern length. If the good_shift[] size calculation wraps, the resulting allocation can be too small and subsequent pattern copies can overflow it. Fix this by rejecting zero-length patterns and by using overflow helpers before calculating the combined allocation size. Signed-off-by: Josh Law --- lib/ts_bm.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/lib/ts_bm.c b/lib/ts_bm.c index eed5967238c5..676105e84005 100644 --- a/lib/ts_bm.c +++ b/lib/ts_bm.c @@ -163,8 +163,22 @@ static struct ts_config *bm_init(const void *pattern, unsigned int len, struct ts_config *conf; struct ts_bm *bm; int i; - unsigned int prefix_tbl_len = len * sizeof(unsigned int); - size_t priv_size = sizeof(*bm) + len + prefix_tbl_len; + unsigned int prefix_tbl_len; + size_t priv_size; + + /* Zero-length patterns would underflow bm_find()'s initial shift. */ + if (unlikely(!len)) + return ERR_PTR(-EINVAL); + + /* + * bm->pattern is stored immediately after the good_shift[] table. + * Reject lengths that would wrap while sizing either region. + */ + if (unlikely(check_mul_overflow(len, sizeof(*bm->good_shift), + &prefix_tbl_len) || + check_add_overflow(sizeof(*bm), (size_t)len, &priv_size) || + check_add_overflow(priv_size, prefix_tbl_len, &priv_size))) + return ERR_PTR(-EINVAL); conf = alloc_ts_config(priv_size, gfp_mask); if (IS_ERR(conf)) -- 2.43.0