* Re: [PATCH v2] lib: Verify array index is correct before using it
2020-07-27 6:59 [PATCH v2] lib: Verify array index is correct before using it Huang Guobin
@ 2020-07-27 6:52 ` Herbert Xu
0 siblings, 0 replies; 4+ messages in thread
From: Herbert Xu @ 2020-07-27 6:52 UTC (permalink / raw)
To: Huang Guobin; +Cc: haren, ddstreet, linux-kernel
On Mon, Jul 27, 2020 at 02:59:10AM -0400, Huang Guobin wrote:
> This code reads from the array before verifying that "c" is a valid
> index. Move test array offset code before use to fix it.
>
> Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
> Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
> ---
> lib/842/842_compress.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
Please post this to linux-crypto@vger.kernel.org.
Thanks,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v2] lib: Verify array index is correct before using it
@ 2020-07-27 6:59 Huang Guobin
2020-07-27 6:52 ` Herbert Xu
0 siblings, 1 reply; 4+ messages in thread
From: Huang Guobin @ 2020-07-27 6:59 UTC (permalink / raw)
To: haren, herbert, ddstreet; +Cc: linux-kernel
This code reads from the array before verifying that "c" is a valid
index. Move test array offset code before use to fix it.
Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
---
lib/842/842_compress.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/lib/842/842_compress.c b/lib/842/842_compress.c
index c02baa4168e1..c37bfe0b9346 100644
--- a/lib/842/842_compress.c
+++ b/lib/842/842_compress.c
@@ -11,6 +11,7 @@
#define MODULE_NAME "842_compress"
#include <linux/hashtable.h>
+#include <linux/nospec.h>
#include "842.h"
#include "842_debugfs.h"
@@ -222,12 +223,14 @@ static int add_bits(struct sw842_param *p, u64 d, u8 n)
static int add_template(struct sw842_param *p, u8 c)
{
int ret, i, b = 0;
- u8 *t = comp_ops[c];
+ u8 *t = NULL;
bool inv = false;
if (c >= OPS_MAX)
return -EINVAL;
+ c = array_index_nospec(c, OPS_MAX);
+ t = comp_ops[c];
pr_debug("template %x\n", t[4]);
ret = add_bits(p, t[4], OP_BITS);
@@ -379,12 +382,14 @@ static int add_end_template(struct sw842_param *p)
static bool check_template(struct sw842_param *p, u8 c)
{
- u8 *t = comp_ops[c];
+ u8 *t = NULL;
int i, match, b = 0;
if (c >= OPS_MAX)
return false;
+ c = array_index_nospec(c, OPS_MAX);
+ t = comp_ops[c];
for (i = 0; i < 4; i++) {
if (t[i] & OP_ACTION_INDEX) {
if (t[i] & OP_AMOUNT_2)
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH v2] lib: Verify array index is correct before using it
2020-07-28 12:21 Huang Guobin
@ 2020-08-20 6:50 ` Herbert Xu
0 siblings, 0 replies; 4+ messages in thread
From: Herbert Xu @ 2020-08-20 6:50 UTC (permalink / raw)
To: Huang Guobin; +Cc: haren, ddstreet, linux-crypto, linux-kernel
On Tue, Jul 28, 2020 at 08:21:57AM -0400, Huang Guobin wrote:
> This code reads from the array before verifying that "c" is a valid
> index. Move test array offset code before use to fix it.
>
> Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
> Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
> ---
> lib/842/842_compress.c | 9 +++++++--
> 1 file changed, 7 insertions(+), 2 deletions(-)
Did you check whether the out-of-bounds condition is even possible?
Cheers,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply [flat|nested] 4+ messages in thread
* [PATCH v2] lib: Verify array index is correct before using it
@ 2020-07-28 12:21 Huang Guobin
2020-08-20 6:50 ` Herbert Xu
0 siblings, 1 reply; 4+ messages in thread
From: Huang Guobin @ 2020-07-28 12:21 UTC (permalink / raw)
To: haren, herbert, ddstreet, linux-crypto; +Cc: linux-kernel
This code reads from the array before verifying that "c" is a valid
index. Move test array offset code before use to fix it.
Fixes: 2da572c959dd ("lib: add software 842 compression/decompression")
Signed-off-by: Huang Guobin <huangguobin4@huawei.com>
---
lib/842/842_compress.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/lib/842/842_compress.c b/lib/842/842_compress.c
index c02baa4168e1..c37bfe0b9346 100644
--- a/lib/842/842_compress.c
+++ b/lib/842/842_compress.c
@@ -11,6 +11,7 @@
#define MODULE_NAME "842_compress"
#include <linux/hashtable.h>
+#include <linux/nospec.h>
#include "842.h"
#include "842_debugfs.h"
@@ -222,12 +223,14 @@ static int add_bits(struct sw842_param *p, u64 d, u8 n)
static int add_template(struct sw842_param *p, u8 c)
{
int ret, i, b = 0;
- u8 *t = comp_ops[c];
+ u8 *t = NULL;
bool inv = false;
if (c >= OPS_MAX)
return -EINVAL;
+ c = array_index_nospec(c, OPS_MAX);
+ t = comp_ops[c];
pr_debug("template %x\n", t[4]);
ret = add_bits(p, t[4], OP_BITS);
@@ -379,12 +382,14 @@ static int add_end_template(struct sw842_param *p)
static bool check_template(struct sw842_param *p, u8 c)
{
- u8 *t = comp_ops[c];
+ u8 *t = NULL;
int i, match, b = 0;
if (c >= OPS_MAX)
return false;
+ c = array_index_nospec(c, OPS_MAX);
+ t = comp_ops[c];
for (i = 0; i < 4; i++) {
if (t[i] & OP_ACTION_INDEX) {
if (t[i] & OP_AMOUNT_2)
--
2.17.1
^ permalink raw reply related [flat|nested] 4+ messages in thread
end of thread, other threads:[~2020-08-20 6:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-27 6:59 [PATCH v2] lib: Verify array index is correct before using it Huang Guobin
2020-07-27 6:52 ` Herbert Xu
2020-07-28 12:21 Huang Guobin
2020-08-20 6:50 ` Herbert Xu
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).