From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f42.google.com (mail-qv1-f42.google.com [209.85.219.42]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7DCF12D5924 for ; Sun, 8 Mar 2026 20:17:57 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.42 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773001078; cv=none; b=RRtkYuPDygEdwNYwIQn9qq0z4V/xvIGzbfQdsNUIQc9EV7rkL1llQ74fY1x7bd7csecVaGyImmJgECMM9AlhvyqAX060aO35cn643J9/mcWi14+8gntAqNpexeCwo9tax6Q7UqOVzlPqZqxxA5DZXXfyfl6uLWnPHUr1C84WQbY= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773001078; c=relaxed/simple; bh=eSs7EQUbyYA4iWRcpi9sfVtGEqdbrL8VQ9NO00Zna8c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=URb+567IRiARtMTjD19SvVktIZaj+k6d12bpzMj22p23hPxUghCimW2PA3NxeTu5WIJt3AVZluFZo9CcAQ8nkoz8QpGohVAEGj0Yjmndy13vLCZtDTy4Hmx8huyIalGbHzC43awBdKhUO43YvuOGX02LaWtvLiWIPNXtWqLyO3o= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=T47iTLKD; arc=none smtp.client-ip=209.85.219.42 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="T47iTLKD" Received: by mail-qv1-f42.google.com with SMTP id 6a1803df08f44-89a1c6dd788so82181386d6.0 for ; Sun, 08 Mar 2026 13:17:57 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773001076; x=1773605876; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=bdTSkHgTzcuf4AbZaEwvD99na1mim+ySpi4STKJBrIk=; b=T47iTLKDuUYU9iD8MfiFGE6Ep8G+RVMhA/pgj77FMrV4dsRBwrf0z27XX8K3+Z1CbA CotlAgDn50l++i6CvEkmFxdkYCpt6W1u73WOhhfMQE1muaQR9SUgrckTJnqPqHOp+A+K OAO0Wji+uIFDBwIYVVCOkooPuBol+oSRmJCffoR4r4S9qu5Mt1Eomvyb+Coy01OJTPFV q21MVRvnPZstEPnmTUn5KRD2ZutDUmYR8bVznCp/wUH4OByiVZ+QEO3H89HE3wnUp1vu OYgP7I6Uvb9rMP6M7GDI6XWmkU1BO9UgVLFu0Jrqz08z+Kkrlf/x5ysIZ55URNW6+sVH NMkg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773001076; x=1773605876; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=bdTSkHgTzcuf4AbZaEwvD99na1mim+ySpi4STKJBrIk=; b=plOR5x9rrGEoSL0Y43luFZwI6Yd+a9so72if0AbrBL2BVgOHuz2UUwFgsrqSuF7mX0 2s8lS6pEWhC3CLlz7bZZ3JpJXjz5zyuasTjbEWfKX6MqAKDcYyZzKnj6XFKIPkOoGGp/ fXBnqELXyVlLfLjvIkqO6NHGVBWA9kAqE+xFsl/NLN4bHu9iAZi7RPV/iqBUM5MWSrVS VC808yF2tzaYFBpVFUQhmXKJMEExfEWZkznVAR7ldZs5prV5vStfu30tIgqurWrTrlnZ x+MYPWBd6eJvsedvY7tSnT7JciCWhZLkJPaM9VUAWew9Jjg3Luflc0TrZGECgh63cZH0 ZShg== X-Gm-Message-State: AOJu0YwOZyKZoF0/fiOUPehk2mollJqmyqA/09l15Dg+Xh3qwFUxoTrW 0nQUHMfh1BAB1/gXDOBE3CkFXam3R2JZ59DUsgvkhCQN1pgAcMBZ0Q1q X-Gm-Gg: ATEYQzwCLjyNnPWJ0rOchjLUCbkjsxFqk6eZrq5FNFeXRLD+KmwyHoQ26D8z3/EbtRP qUDMnJTAuv+3Q0THyOjmpctjUeOdvaNAcab8cbjrstslYRAHxwAXJVv/snWmkKyrqgU3HJD88gF fynVM4aM1dLy0M02g2Z/q7lzv2NX5ifrwM6HL438v/LOmp3mLGhxV/8QrMIqADIhwXQ4HXuHKSe 52vpCauwGZTOCB9sdeOuYCh0BvdvBVGLXr2DZdmXXyLRgE4/asZex7emNTvftoGxXuJtK1GBd4L DX8a4mAGa//zLEIc3sNCf6lfVJRjAkIzR0D2xHY9Yhgba0W54EhDsNy0a5lPAE9KYTVrJzRcG+8 DMPwkjLei6maiSgzKqKNLIRlri1g7UCIgENbEq3EVa6/UjgQotrL9jWxfh2QiF0jVqcMEAbg4DL +eHfLO8ulZU1UmjGUUgLEkaYZzLSxdPrSmL9HH9WyS6hdl/4rNqafFvv5ZFIkj5YYuj/2AgiW0g iIU X-Received: by 2002:ad4:5cae:0:b0:89a:1069:d224 with SMTP id 6a1803df08f44-89a30a64522mr143584616d6.18.1773001076415; Sun, 08 Mar 2026 13:17:56 -0700 (PDT) Received: from instance-20260207-1316.vcn12250046.oraclevcn.com ([150.136.248.187]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-89a316eca85sm58264186d6.41.2026.03.08.13.17.55 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Mar 2026 13:17:56 -0700 (PDT) From: Josh Law X-Google-Original-From: Josh Law To: Andrew Morton Cc: linux-kernel@vger.kernel.org, Josh Law Subject: [PATCH v3 2/2] lib/ts_kmp: fix integer overflow in pattern length calculation Date: Sun, 8 Mar 2026 20:17:53 +0000 Message-ID: <20260308201753.2889216-2-objecting@objecting.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260308201753.2889216-1-objecting@objecting.org> References: <20260308125519.dc842722209726977a8e14cc@linux-foundation.org> <20260308201753.2889216-1-objecting@objecting.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Josh Law Changes in v3: - mirror the ts_bm review fixes for consistency across the series - move overflow checks before the arithmetic they guard - add comments and use overflow.h helpers for the allocation math The ts_kmp algorithm stores its prefix_tbl[] table and pattern in a single allocation sized from the pattern length. If the prefix_tbl[] size calculation wraps, the resulting allocation can be too small and subsequent pattern copies can overflow it. Fix this by rejecting zero-length patterns and by using overflow helpers before calculating the combined allocation size. Signed-off-by: Josh Law --- lib/ts_kmp.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/lib/ts_kmp.c b/lib/ts_kmp.c index 5520dc28255a..29466c1803c9 100644 --- a/lib/ts_kmp.c +++ b/lib/ts_kmp.c @@ -94,8 +94,22 @@ static struct ts_config *kmp_init(const void *pattern, unsigned int len, struct ts_config *conf; struct ts_kmp *kmp; int i; - unsigned int prefix_tbl_len = len * sizeof(unsigned int); - size_t priv_size = sizeof(*kmp) + len + prefix_tbl_len; + unsigned int prefix_tbl_len; + size_t priv_size; + + /* Zero-length patterns would make kmp_find() read beyond kmp->pattern. */ + if (unlikely(!len)) + return ERR_PTR(-EINVAL); + + /* + * kmp->pattern is stored immediately after the prefix_tbl[] table. + * Reject lengths that would wrap while sizing either region. + */ + if (unlikely(check_mul_overflow(len, sizeof(*kmp->prefix_tbl), + &prefix_tbl_len) || + check_add_overflow(sizeof(*kmp), (size_t)len, &priv_size) || + check_add_overflow(priv_size, prefix_tbl_len, &priv_size))) + return ERR_PTR(-EINVAL); conf = alloc_ts_config(priv_size, gfp_mask); if (IS_ERR(conf)) -- 2.43.0