* [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error
@ 2017-03-20 14:23 Colin King
[not found] ` <20170320142336.10997-1-colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
0 siblings, 1 reply; 9+ messages in thread
From: Colin King @ 2017-03-20 14:23 UTC (permalink / raw)
To: Peter Huewe, Marcel Selhorst, Jarkko Sakkinen, Jason Gunthorpe,
tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f
Cc: kernel-janitors-u79uwXL29TY76Z2rM5mHXA,
linux-kernel-u79uwXL29TY76Z2rM5mHXA
From: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
The comparison of an out of range index into space->context_tbl is
off-by-one and should be using >= rather than > in the comparison.
Detected by CoverityScan, CID#1419694 ("Out-of-bounds read")
Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code")
Signed-off-by: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
---
drivers/char/tpm/tpm2-space.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c
index d36d81e07076..009934269514 100644
--- a/drivers/char/tpm/tpm2-space.c
+++ b/drivers/char/tpm/tpm2-space.c
@@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle)
int i;
i = 0xFFFFFF - (vhandle & 0xFFFFFF);
- if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i])
+ if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i])
return false;
phandle = space->context_tbl[i];
--
2.11.0
------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
^ permalink raw reply related [flat|nested] 9+ messages in thread[parent not found: <20170320142336.10997-1-colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>]
* Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error [not found] ` <20170320142336.10997-1-colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> @ 2017-03-22 11:42 ` Jarkko Sakkinen 2017-03-22 11:45 ` Colin Ian King 0 siblings, 1 reply; 9+ messages in thread From: Jarkko Sakkinen @ 2017-03-22 11:42 UTC (permalink / raw) To: Colin King Cc: kernel-janitors-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA, tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > From: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > > The comparison of an out of range index into space->context_tbl is > off-by-one and should be using >= rather than > in the comparison. > > Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > > Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > Signed-off-by: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > --- > drivers/char/tpm/tpm2-space.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > index d36d81e07076..009934269514 100644 > --- a/drivers/char/tpm/tpm2-space.c > +++ b/drivers/char/tpm/tpm2-space.c > @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > int i; > > i = 0xFFFFFF - (vhandle & 0xFFFFFF); > - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > return false; > > phandle = space->context_tbl[i]; > -- > 2.11.0 Thanks. If you don't mind, I would squash this to that patch? /Jarkko ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error 2017-03-22 11:42 ` Jarkko Sakkinen @ 2017-03-22 11:45 ` Colin Ian King 2017-03-22 13:12 ` Dan Carpenter [not found] ` <d96bb5c9-e1b3-abe5-2273-fc525dc00190-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> 0 siblings, 2 replies; 9+ messages in thread From: Colin Ian King @ 2017-03-22 11:45 UTC (permalink / raw) To: Jarkko Sakkinen Cc: Peter Huewe, Marcel Selhorst, Jason Gunthorpe, tpmdd-devel, kernel-janitors, linux-kernel On 22/03/17 11:42, Jarkko Sakkinen wrote: > On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: >> From: Colin Ian King <colin.king@canonical.com> >> >> The comparison of an out of range index into space->context_tbl is >> off-by-one and should be using >= rather than > in the comparison. >> >> Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") >> >> Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") >> Signed-off-by: Colin Ian King <colin.king@canonical.com> >> --- >> drivers/char/tpm/tpm2-space.c | 2 +- >> 1 file changed, 1 insertion(+), 1 deletion(-) >> >> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c >> index d36d81e07076..009934269514 100644 >> --- a/drivers/char/tpm/tpm2-space.c >> +++ b/drivers/char/tpm/tpm2-space.c >> @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) >> int i; >> >> i = 0xFFFFFF - (vhandle & 0xFFFFFF); >> - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) >> + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) >> return false; >> >> phandle = space->context_tbl[i]; >> -- >> 2.11.0 > > Thanks. If you don't mind, I would squash this to that patch? > > /Jarkko > Sure squash it, and maybe add a Reported-by: Colin Ian King <colin.king@canonical.com> if that's OK with you. Colin ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error 2017-03-22 11:45 ` Colin Ian King @ 2017-03-22 13:12 ` Dan Carpenter 2017-03-23 15:53 ` Jarkko Sakkinen [not found] ` <d96bb5c9-e1b3-abe5-2273-fc525dc00190-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> 1 sibling, 1 reply; 9+ messages in thread From: Dan Carpenter @ 2017-03-22 13:12 UTC (permalink / raw) To: Colin Ian King Cc: Jarkko Sakkinen, Peter Huewe, Marcel Selhorst, Jason Gunthorpe, tpmdd-devel, kernel-janitors, linux-kernel On Wed, Mar 22, 2017 at 11:45:37AM +0000, Colin Ian King wrote: > On 22/03/17 11:42, Jarkko Sakkinen wrote: > > On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > >> From: Colin Ian King <colin.king@canonical.com> > >> > >> The comparison of an out of range index into space->context_tbl is > >> off-by-one and should be using >= rather than > in the comparison. > >> > >> Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > >> > >> Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > >> Signed-off-by: Colin Ian King <colin.king@canonical.com> > >> --- > >> drivers/char/tpm/tpm2-space.c | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > >> > >> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > >> index d36d81e07076..009934269514 100644 > >> --- a/drivers/char/tpm/tpm2-space.c > >> +++ b/drivers/char/tpm/tpm2-space.c > >> @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > >> int i; > >> > >> i = 0xFFFFFF - (vhandle & 0xFFFFFF); > >> - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > >> + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > >> return false; > >> > >> phandle = space->context_tbl[i]; > >> -- > >> 2.11.0 > > > > Thanks. If you don't mind, I would squash this to that patch? > > > > /Jarkko > > > Sure squash it, and maybe add a Reported-by: Colin Ian King > <colin.king@canonical.com> if that's OK with you. Reported-by isn't really correct though... We should have a Fixes-from: tag for squashed fixes. regards, dan carpenter ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error 2017-03-22 13:12 ` Dan Carpenter @ 2017-03-23 15:53 ` Jarkko Sakkinen 2017-03-23 16:23 ` Jarkko Sakkinen 2017-03-23 16:42 ` Dan Carpenter 0 siblings, 2 replies; 9+ messages in thread From: Jarkko Sakkinen @ 2017-03-23 15:53 UTC (permalink / raw) To: Dan Carpenter Cc: Colin Ian King, Peter Huewe, Marcel Selhorst, Jason Gunthorpe, tpmdd-devel, kernel-janitors, linux-kernel On Wed, Mar 22, 2017 at 04:12:49PM +0300, Dan Carpenter wrote: > On Wed, Mar 22, 2017 at 11:45:37AM +0000, Colin Ian King wrote: > > On 22/03/17 11:42, Jarkko Sakkinen wrote: > > > On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > > >> From: Colin Ian King <colin.king@canonical.com> > > >> > > >> The comparison of an out of range index into space->context_tbl is > > >> off-by-one and should be using >= rather than > in the comparison. > > >> > > >> Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > > >> > > >> Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > > >> Signed-off-by: Colin Ian King <colin.king@canonical.com> > > >> --- > > >> drivers/char/tpm/tpm2-space.c | 2 +- > > >> 1 file changed, 1 insertion(+), 1 deletion(-) > > >> > > >> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > > >> index d36d81e07076..009934269514 100644 > > >> --- a/drivers/char/tpm/tpm2-space.c > > >> +++ b/drivers/char/tpm/tpm2-space.c > > >> @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > > >> int i; > > >> > > >> i = 0xFFFFFF - (vhandle & 0xFFFFFF); > > >> - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > >> + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > >> return false; > > >> > > >> phandle = space->context_tbl[i]; > > >> -- > > >> 2.11.0 > > > > > > Thanks. If you don't mind, I would squash this to that patch? > > > > > > /Jarkko > > > > > Sure squash it, and maybe add a Reported-by: Colin Ian King > > <colin.king@canonical.com> if that's OK with you. > > Reported-by isn't really correct though... We should have a Fixes-from: > tag for squashed fixes. > > regards, > dan carpenter Hmm... Maybe so depending on how you interpret Reported-by but Fixes-from is not something that is used at the moment, is it? /Jarkko ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error 2017-03-23 15:53 ` Jarkko Sakkinen @ 2017-03-23 16:23 ` Jarkko Sakkinen 2017-03-23 16:42 ` Dan Carpenter 1 sibling, 0 replies; 9+ messages in thread From: Jarkko Sakkinen @ 2017-03-23 16:23 UTC (permalink / raw) To: Dan Carpenter Cc: Colin Ian King, Peter Huewe, Marcel Selhorst, Jason Gunthorpe, tpmdd-devel, kernel-janitors, linux-kernel, linux-security-module On Thu, Mar 23, 2017 at 05:53:58PM +0200, Jarkko Sakkinen wrote: > On Wed, Mar 22, 2017 at 04:12:49PM +0300, Dan Carpenter wrote: > > On Wed, Mar 22, 2017 at 11:45:37AM +0000, Colin Ian King wrote: > > > On 22/03/17 11:42, Jarkko Sakkinen wrote: > > > > On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > > > >> From: Colin Ian King <colin.king@canonical.com> > > > >> > > > >> The comparison of an out of range index into space->context_tbl is > > > >> off-by-one and should be using >= rather than > in the comparison. > > > >> > > > >> Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > > > >> > > > >> Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > > > >> Signed-off-by: Colin Ian King <colin.king@canonical.com> > > > >> --- > > > >> drivers/char/tpm/tpm2-space.c | 2 +- > > > >> 1 file changed, 1 insertion(+), 1 deletion(-) > > > >> > > > >> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > > > >> index d36d81e07076..009934269514 100644 > > > >> --- a/drivers/char/tpm/tpm2-space.c > > > >> +++ b/drivers/char/tpm/tpm2-space.c > > > >> @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > > > >> int i; > > > >> > > > >> i = 0xFFFFFF - (vhandle & 0xFFFFFF); > > > >> - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > > >> + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > > >> return false; > > > >> > > > >> phandle = space->context_tbl[i]; > > > >> -- > > > >> 2.11.0 > > > > > > > > Thanks. If you don't mind, I would squash this to that patch? > > > > > > > > /Jarkko > > > > > > > Sure squash it, and maybe add a Reported-by: Colin Ian King > > > <colin.king@canonical.com> if that's OK with you. > > > > Reported-by isn't really correct though... We should have a Fixes-from: > > tag for squashed fixes. > > > > regards, > > dan carpenter > > Hmm... Maybe so depending on how you interpret Reported-by but > Fixes-from is not something that is used at the moment, is it? > > /Jarkko When I started squashing the commit I realized what you meant so I'm adding this to the commit: Fixes-from: Colin Ian King <colin.king@canonical.com> /Jarkko ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error 2017-03-23 15:53 ` Jarkko Sakkinen 2017-03-23 16:23 ` Jarkko Sakkinen @ 2017-03-23 16:42 ` Dan Carpenter 2017-03-23 18:12 ` Jarkko Sakkinen 1 sibling, 1 reply; 9+ messages in thread From: Dan Carpenter @ 2017-03-23 16:42 UTC (permalink / raw) To: Jarkko Sakkinen Cc: Colin Ian King, Peter Huewe, Marcel Selhorst, Jason Gunthorpe, tpmdd-devel, kernel-janitors, linux-kernel On Thu, Mar 23, 2017 at 05:53:58PM +0200, Jarkko Sakkinen wrote: > On Wed, Mar 22, 2017 at 04:12:49PM +0300, Dan Carpenter wrote: > > On Wed, Mar 22, 2017 at 11:45:37AM +0000, Colin Ian King wrote: > > > On 22/03/17 11:42, Jarkko Sakkinen wrote: > > > > On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > > > >> From: Colin Ian King <colin.king@canonical.com> > > > >> > > > >> The comparison of an out of range index into space->context_tbl is > > > >> off-by-one and should be using >= rather than > in the comparison. > > > >> > > > >> Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > > > >> > > > >> Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > > > >> Signed-off-by: Colin Ian King <colin.king@canonical.com> > > > >> --- > > > >> drivers/char/tpm/tpm2-space.c | 2 +- > > > >> 1 file changed, 1 insertion(+), 1 deletion(-) > > > >> > > > >> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > > > >> index d36d81e07076..009934269514 100644 > > > >> --- a/drivers/char/tpm/tpm2-space.c > > > >> +++ b/drivers/char/tpm/tpm2-space.c > > > >> @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > > > >> int i; > > > >> > > > >> i = 0xFFFFFF - (vhandle & 0xFFFFFF); > > > >> - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > > >> + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > > >> return false; > > > >> > > > >> phandle = space->context_tbl[i]; > > > >> -- > > > >> 2.11.0 > > > > > > > > Thanks. If you don't mind, I would squash this to that patch? > > > > > > > > /Jarkko > > > > > > > Sure squash it, and maybe add a Reported-by: Colin Ian King > > > <colin.king@canonical.com> if that's OK with you. > > > > Reported-by isn't really correct though... We should have a Fixes-from: > > tag for squashed fixes. > > > > regards, > > dan carpenter > > Hmm... Maybe so depending on how you interpret Reported-by but > Fixes-from is not something that is used at the moment, is it? No, but we should create it. regards, dan carpenter ^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error 2017-03-23 16:42 ` Dan Carpenter @ 2017-03-23 18:12 ` Jarkko Sakkinen 0 siblings, 0 replies; 9+ messages in thread From: Jarkko Sakkinen @ 2017-03-23 18:12 UTC (permalink / raw) To: Dan Carpenter Cc: kernel-janitors-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA, tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f, Colin Ian King On Thu, Mar 23, 2017 at 07:42:09PM +0300, Dan Carpenter wrote: > On Thu, Mar 23, 2017 at 05:53:58PM +0200, Jarkko Sakkinen wrote: > > On Wed, Mar 22, 2017 at 04:12:49PM +0300, Dan Carpenter wrote: > > > On Wed, Mar 22, 2017 at 11:45:37AM +0000, Colin Ian King wrote: > > > > On 22/03/17 11:42, Jarkko Sakkinen wrote: > > > > > On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > > > > >> From: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > > > > >> > > > > >> The comparison of an out of range index into space->context_tbl is > > > > >> off-by-one and should be using >= rather than > in the comparison. > > > > >> > > > > >> Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > > > > >> > > > > >> Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > > > > >> Signed-off-by: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > > > > >> --- > > > > >> drivers/char/tpm/tpm2-space.c | 2 +- > > > > >> 1 file changed, 1 insertion(+), 1 deletion(-) > > > > >> > > > > >> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > > > > >> index d36d81e07076..009934269514 100644 > > > > >> --- a/drivers/char/tpm/tpm2-space.c > > > > >> +++ b/drivers/char/tpm/tpm2-space.c > > > > >> @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > > > > >> int i; > > > > >> > > > > >> i = 0xFFFFFF - (vhandle & 0xFFFFFF); > > > > >> - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > > > >> + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > > > > >> return false; > > > > >> > > > > >> phandle = space->context_tbl[i]; > > > > >> -- > > > > >> 2.11.0 > > > > > > > > > > Thanks. If you don't mind, I would squash this to that patch? > > > > > > > > > > /Jarkko > > > > > > > > > Sure squash it, and maybe add a Reported-by: Colin Ian King > > > > <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> if that's OK with you. > > > > > > Reported-by isn't really correct though... We should have a Fixes-from: > > > tag for squashed fixes. > > > > > > regards, > > > dan carpenter > > > > Hmm... Maybe so depending on how you interpret Reported-by but > > Fixes-from is not something that is used at the moment, is it? > > No, but we should create it. > > regards, > dan carpenter Fully agreed. Using reported-by in the commit in question implies as if the whole commit was proposed by Colin. /Jarkko ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot ^ permalink raw reply [flat|nested] 9+ messages in thread
[parent not found: <d96bb5c9-e1b3-abe5-2273-fc525dc00190-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>]
* Re: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error [not found] ` <d96bb5c9-e1b3-abe5-2273-fc525dc00190-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> @ 2017-03-23 15:51 ` Jarkko Sakkinen 0 siblings, 0 replies; 9+ messages in thread From: Jarkko Sakkinen @ 2017-03-23 15:51 UTC (permalink / raw) To: Colin Ian King Cc: kernel-janitors-u79uwXL29TY76Z2rM5mHXA, linux-kernel-u79uwXL29TY76Z2rM5mHXA, tpmdd-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f On Wed, Mar 22, 2017 at 11:45:37AM +0000, Colin Ian King wrote: > On 22/03/17 11:42, Jarkko Sakkinen wrote: > > On Mon, Mar 20, 2017 at 02:23:36PM +0000, Colin King wrote: > >> From: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > >> > >> The comparison of an out of range index into space->context_tbl is > >> off-by-one and should be using >= rather than > in the comparison. > >> > >> Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") > >> > >> Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") > >> Signed-off-by: Colin Ian King <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> > >> --- > >> drivers/char/tpm/tpm2-space.c | 2 +- > >> 1 file changed, 1 insertion(+), 1 deletion(-) > >> > >> diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c > >> index d36d81e07076..009934269514 100644 > >> --- a/drivers/char/tpm/tpm2-space.c > >> +++ b/drivers/char/tpm/tpm2-space.c > >> @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) > >> int i; > >> > >> i = 0xFFFFFF - (vhandle & 0xFFFFFF); > >> - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > >> + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) > >> return false; > >> > >> phandle = space->context_tbl[i]; > >> -- > >> 2.11.0 > > > > Thanks. If you don't mind, I would squash this to that patch? > > > > /Jarkko > > > Sure squash it, and maybe add a Reported-by: Colin Ian King > <colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org> if that's OK with you. > > Colin Thanks I'll do that! /Jarkko ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, Slashdot.org! http://sdm.link/slashdot ^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2017-03-23 18:12 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2017-03-20 14:23 [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error Colin King
[not found] ` <20170320142336.10997-1-colin.king-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
2017-03-22 11:42 ` Jarkko Sakkinen
2017-03-22 11:45 ` Colin Ian King
2017-03-22 13:12 ` Dan Carpenter
2017-03-23 15:53 ` Jarkko Sakkinen
2017-03-23 16:23 ` Jarkko Sakkinen
2017-03-23 16:42 ` Dan Carpenter
2017-03-23 18:12 ` Jarkko Sakkinen
[not found] ` <d96bb5c9-e1b3-abe5-2273-fc525dc00190-Z7WLFzj8eWMS+FvcfC7Uqw@public.gmane.org>
2017-03-23 15:51 ` Jarkko Sakkinen
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).