From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qk1-f174.google.com (mail-qk1-f174.google.com [209.85.222.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 38D361DDC2B for ; Sun, 8 Mar 2026 20:20:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773001232; cv=none; b=Ppc4GZNeVPbOV0IdMwP1x1wg+4kDQ6792Rao+1VSbh0Gr2Yla1wMJmrWOWn2bJlK1yEnUnDMKTlQoVP1waCGun1GcFFAd/Esa/cnj2gbYJnatTviBieXqGrMktH6vNEvAoLw8RadKQ3c3FqOQNfeMG6HS3qmTDM9w1gUYohqio4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773001232; c=relaxed/simple; bh=Do3lvraRPJPfDUjPEndZYl8TZWWV/c+QIpilV61DBt0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=PXWlWQj7nEKw3MXHK0AXvDsoUzXgGDDzLrX5qiltlaXCNtXpHfYdobR6bFNniipXus5EMdOWTZt2KFsUPBAvs1HMfJr74KWryOuJd5SBvEyJ9/5+Fx/hqS5Lo8V60JybDgnNYxYNgYn878if2aeemimXFz8yIy2G2EC6KaUK+yk= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=J2xbRoiR; arc=none smtp.client-ip=209.85.222.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="J2xbRoiR" Received: by mail-qk1-f174.google.com with SMTP id af79cd13be357-8cb3bae8d3eso1021449685a.1 for ; Sun, 08 Mar 2026 13:20:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773001230; x=1773606030; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=bxs7TzLvMhb5FxtEzmIDewlCdxuIuN9fasqFJP3wBfY=; b=J2xbRoiRZ3jn4C8SWMz5p5g7sUprAMgazj/0Ahf6eLw8syHDzPoysSjSZkwndFhhai 0A1ALl0cIO7DPHcRzViE+oVx4IUoeY4JF0UQvJEoEs5bL/BuJ4mb9UX618K+xSzUop7B Fwda5YLffii8n9jrpmXFWpYVC9nutpK5GgIgbeB12bHBQlUWdMEHRD6Ov9vDZFGkjwKm IwsYEInGWmwHsqoySkcdYgsvo8CoWTFYCr9Uh3DjK66Vt/AfY4/3NJNDjkccmDEicZeo Kl1OrEYoAmk+1RgUkRusp90P+by0Fary8uKbNxId0ZYophysUbuXFuHXilGR1w4N1jCM FjrA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773001230; x=1773606030; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=bxs7TzLvMhb5FxtEzmIDewlCdxuIuN9fasqFJP3wBfY=; b=HJI/OOko6XhwCSX8Rc7wVxidrlJERuM/xPJblIARpGpCLrBMa2rdJGN5Y1W7SVCNtD SEZ2059q9dOkYV74h4YVUytpN70vDrdKfKRUcSTHCgfMX7osz5I1dbKlxHzI0g9YQuOP 7PyDqvpjcxWI4Dl5AZEdTdzBcuBNWMUnxppQGkJr0yyqFVzUtX0c3qTe68rSyzFyAx0B QdPqQ4k0x/RE8gPKbqHByPZ5G+ZFaBKOy/VFcRPihxcdDWCA/zTpCOCO3ZudFVuJr7hS asefWJxxe6NqNTqs6vMb4t8v468bj7YggTXHtS4uY+QdFei4L7B9AGqDI2uCbJfOfwBO TR8w== X-Gm-Message-State: AOJu0YwGm1bzelaVpIaI+A4AZx/rc4XTChpVskDTvFme8da4d+KehtJi bCFDEpLQrBI4RtGFIAPj+eAbaLBS42HQ48VLkk6VWLzrkdYIFWjl4j7L X-Gm-Gg: ATEYQzx2PeOmfdQHn5CAHuM9MVhlko9gDMsCE7CBxOuVSZ32sU+8rrj+rfyTfB6n4F1 /97+8juLmSpN44SZln3ztnXeCRtIm0nU0NrYROdIvumFgdU8+rgt153wAW0gGq0cl2SUWR0+RMO 25vB6BDxc8VgwtUE7Bw5PuQp6sjfpcuM8DCYkvXz0kINZ7pciKH5ol0gAjmluIgq6yYcIMaTml3 kJ7LdZgA9UOL0LcHaI+4pQB5F5wj0ZQrKaCZZIuff2cwCN76giv9VtAenbqjOljpF0EzmuKNQks YBYjsIVtJwAz7q9cx6CvE4Z7Pwr9KOcKFSwFtWyX/UQruekYVirR+w/bIMcubfC2N/P48upi7b/ sVON7o3dghCK0XCbONO3T65q6ij2DfYvbd1yVhQzjLNDG75g7Ti0KCxzm6vxZq82r5v40tLNlAV GYr0Z9y/DoUhRHxpTaKxFolv3OJVx++0wUL9d8wML42T4vEFStqIIiW7sLTfzVNHEtAeS+tqSpK WKQ X-Received: by 2002:a05:620a:19a1:b0:8cb:4543:c5c5 with SMTP id af79cd13be357-8cd6d36dc86mr1184080185a.22.1773001230082; Sun, 08 Mar 2026 13:20:30 -0700 (PDT) Received: from instance-20260207-1316.vcn12250046.oraclevcn.com ([150.136.248.187]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-89a316ea1bcsm62616576d6.43.2026.03.08.13.20.28 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Mar 2026 13:20:28 -0700 (PDT) From: Josh Law X-Google-Original-From: Josh Law To: Andrew Morton Cc: linux-kernel@vger.kernel.org, Josh Law Subject: [PATCH v3 1/2] lib/ts_bm: fix integer overflow in pattern length calculation Date: Sun, 8 Mar 2026 20:20:27 +0000 Message-ID: <20260308202028.2889285-1-objecting@objecting.org> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Josh Law Changes in v3: - move overflow checks before the arithmetic they guard - add comments explaining the zero-length and size-overflow cases - use check_mul_overflow() and check_add_overflow() from overflow.h The ts_bm algorithm stores its good_shift[] table and pattern in a single allocation sized from the pattern length. If the good_shift[] size calculation wraps, the resulting allocation can be too small and subsequent pattern copies can overflow it. Fix this by rejecting zero-length patterns and by using overflow helpers before calculating the combined allocation size. Signed-off-by: Josh Law --- lib/ts_bm.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/lib/ts_bm.c b/lib/ts_bm.c index eed5967238c5..676105e84005 100644 --- a/lib/ts_bm.c +++ b/lib/ts_bm.c @@ -163,8 +163,22 @@ static struct ts_config *bm_init(const void *pattern, unsigned int len, struct ts_config *conf; struct ts_bm *bm; int i; - unsigned int prefix_tbl_len = len * sizeof(unsigned int); - size_t priv_size = sizeof(*bm) + len + prefix_tbl_len; + unsigned int prefix_tbl_len; + size_t priv_size; + + /* Zero-length patterns would underflow bm_find()'s initial shift. */ + if (unlikely(!len)) + return ERR_PTR(-EINVAL); + + /* + * bm->pattern is stored immediately after the good_shift[] table. + * Reject lengths that would wrap while sizing either region. + */ + if (unlikely(check_mul_overflow(len, sizeof(*bm->good_shift), + &prefix_tbl_len) || + check_add_overflow(sizeof(*bm), (size_t)len, &priv_size) || + check_add_overflow(priv_size, prefix_tbl_len, &priv_size))) + return ERR_PTR(-EINVAL); conf = alloc_ts_config(priv_size, gfp_mask); if (IS_ERR(conf)) -- 2.43.0