From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f44.google.com (mail-qv1-f44.google.com [209.85.219.44]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id BC6C52E5B2D for ; Sun, 8 Mar 2026 20:20:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.44 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773001232; cv=none; b=OgfUCmKPqSz54x1m8a4Pao89lLAHvlkFvNOMZbQsusE6DoPDpB3ORJAqBebmZRKHCDgu9FicwpSjei7It/JA8ytlkTok22dGnzx3VkUCnUNjPbcLODe5TmJ1vuR8pqJrXDvyOoOp/5xyFtAGPTSc+/OFyELWi9iXcwWzK6pq8vE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1773001232; c=relaxed/simple; bh=eSs7EQUbyYA4iWRcpi9sfVtGEqdbrL8VQ9NO00Zna8c=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=di5vCbTHtMJTagejo1JnHot+aTbhiStzUgRMl/CuvNRMPryHrEIRFtgNjWNOGXpONX1G3zLu/KBQn9tVZA97uaaCvAb/m07iZ82ZyVhQWf7mWZ5zbWPSWxlXjMUQ0koMmdvoSpxZ6UM9SMX83hAx+jINQsHx7evJxGzKRE3lkH8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=aJNae8FG; arc=none smtp.client-ip=209.85.219.44 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="aJNae8FG" Received: by mail-qv1-f44.google.com with SMTP id 6a1803df08f44-89a465bd7edso4427436d6.0 for ; Sun, 08 Mar 2026 13:20:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1773001231; x=1773606031; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=bdTSkHgTzcuf4AbZaEwvD99na1mim+ySpi4STKJBrIk=; b=aJNae8FG/90188pawh/LqAqQER/IoG8kiqsGKS7BOiXSL0jCOH3QWmY3vY1Eh28m11 fSkykC5IQEwAkwGWvQrIwdzYoApMeGiz7mA5dIxevXvyvKto5I/eaXSi5fis72JW0qJB qp49u1gouO7uHIwSMIVFS0KlSFJ2Im/n4wJzhnbybHUFh4GlJFyLsEIIa8+azMgAEe/h wCC/xzozXkLe+/Q60bYznjrk7Rpu/yav3FFkaZV7hy6nW8MADA9ZZHNLBZBfk05T8UcQ vS+0Ri1YT11mzNx1au1eDQ0E3YYRYc252CfAvydbq5612NFL76iW8kbDgJ1G0tXR01X1 Yx/g== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1773001231; x=1773606031; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to; bh=bdTSkHgTzcuf4AbZaEwvD99na1mim+ySpi4STKJBrIk=; b=q/bIYxN1Drc9cXbg6eiEc8UERcIdtDcjQC5TqDADn/XwnDrbekOyYrX1ae5FNxnBCW 4fPQx4LjLlLmwt0d99JFhnMYZrn5xjH+oUTF18+IK4vaoQm8jNJKqh3uL772VJuOHrvQ c7Bth+HQJtWHe5R3lX3ek9i0uXFI2hOtE2j3A/ykO5POLyqBNJGvOkW496TsjbyYtKnU aT9f/iiqqyuEz3aat8GbZUtK/OUkLp0wcbPi08jAzpW4pXU7HK1bX+uHx80QWX4HJdhl JeWsVjCh1W15nyZq/QTUSIiqf1DuiJOBJqPU1MAXG4NVTtVDFhiMP3p5ECUgtQ6Qq35D /VmQ== X-Gm-Message-State: AOJu0YzQhBh/IDiC6ot5MIuv53h5+4XIsyx6XiuOHCwioyq7hN7EkJr8 ruIHccJc+URqykQhUCOjU+XE3lxOlWFsZjDk4Hzuy5M4P9RqZaQNkQcbn122r3XJGn4= X-Gm-Gg: ATEYQzwO7HeT62GIA4mUhXwkzRs1/7+yogqjzldIBUdolWCZyCZ1OnTl71Vg1kVg/D4 ojP7GjysD3BqgV2ogq53LjYQdjHwOyvAUk0Gk35Lp84QzBjMlpq7kR8lwlW3GurdANt+dc8GWrJ C6JwIGIJo4pgPo7/tGrdDkQJTPKAfYav/Cp8NVRexbz/xnnEkwZBO9fSCXIaXo0hCVRGXlDKQLs LFC+E6RAt4R/tSnuaowchyWh2nfiauhkNgxE7X8oSuAZ8Fb+U3W9Mp4rxb1SC1wo8ORncd6x1qr CN7zEePSiF45zJFwH15RC3wvsJmaDHIa6pRbutTBdHFRRDxH2ON0QRzgWsYlR3+YM0EmxDpfXLT hdqvIdVFrl1+ntRrYX7q83p/KBfPnSmpAgH14lkMJMr+aTpLOJyvsmROgxxdC1I/P6ZYmDhaueq DdU2x+5rlHvC5Mlw1srAA9vG4lrOVoAysWyVxgVG/+t/k8I5o7Rj2TVJnCk2xTuR3l7vL2R31+r lHP X-Received: by 2002:a05:6214:21a1:b0:899:bc85:7b68 with SMTP id 6a1803df08f44-89a30a2b086mr137715396d6.16.1773001230665; Sun, 08 Mar 2026 13:20:30 -0700 (PDT) Received: from instance-20260207-1316.vcn12250046.oraclevcn.com ([150.136.248.187]) by smtp.gmail.com with ESMTPSA id 6a1803df08f44-89a316ea1bcsm62616576d6.43.2026.03.08.13.20.30 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 08 Mar 2026 13:20:30 -0700 (PDT) From: Josh Law X-Google-Original-From: Josh Law To: Andrew Morton Cc: linux-kernel@vger.kernel.org, Josh Law Subject: [PATCH v3 2/2] lib/ts_kmp: fix integer overflow in pattern length calculation Date: Sun, 8 Mar 2026 20:20:28 +0000 Message-ID: <20260308202028.2889285-2-objecting@objecting.org> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20260308202028.2889285-1-objecting@objecting.org> References: <20260308202028.2889285-1-objecting@objecting.org> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Josh Law Changes in v3: - mirror the ts_bm review fixes for consistency across the series - move overflow checks before the arithmetic they guard - add comments and use overflow.h helpers for the allocation math The ts_kmp algorithm stores its prefix_tbl[] table and pattern in a single allocation sized from the pattern length. If the prefix_tbl[] size calculation wraps, the resulting allocation can be too small and subsequent pattern copies can overflow it. Fix this by rejecting zero-length patterns and by using overflow helpers before calculating the combined allocation size. Signed-off-by: Josh Law --- lib/ts_kmp.c | 18 ++++++++++++++++-- 1 file changed, 16 insertions(+), 2 deletions(-) diff --git a/lib/ts_kmp.c b/lib/ts_kmp.c index 5520dc28255a..29466c1803c9 100644 --- a/lib/ts_kmp.c +++ b/lib/ts_kmp.c @@ -94,8 +94,22 @@ static struct ts_config *kmp_init(const void *pattern, unsigned int len, struct ts_config *conf; struct ts_kmp *kmp; int i; - unsigned int prefix_tbl_len = len * sizeof(unsigned int); - size_t priv_size = sizeof(*kmp) + len + prefix_tbl_len; + unsigned int prefix_tbl_len; + size_t priv_size; + + /* Zero-length patterns would make kmp_find() read beyond kmp->pattern. */ + if (unlikely(!len)) + return ERR_PTR(-EINVAL); + + /* + * kmp->pattern is stored immediately after the prefix_tbl[] table. + * Reject lengths that would wrap while sizing either region. + */ + if (unlikely(check_mul_overflow(len, sizeof(*kmp->prefix_tbl), + &prefix_tbl_len) || + check_add_overflow(sizeof(*kmp), (size_t)len, &priv_size) || + check_add_overflow(priv_size, prefix_tbl_len, &priv_size))) + return ERR_PTR(-EINVAL); conf = alloc_ts_config(priv_size, gfp_mask); if (IS_ERR(conf)) -- 2.43.0