github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

misc: nsm: fix CBOR short-length decoding

Browse Source 
CBOR encodes byte-string lengths from 0 through 23 directly in the
additional-information field. cbor_object_get_array() only handles 23,
so shorter byte strings leave array_len uninitialized. Reserved values
28 through 30 and the unsupported indefinite-length encoding also fall
through without assigning it.

parse_resp_get_random() then uses the indeterminate value for bounds
checking and as the byte count returned to the hwrng core. This can
reject a valid short response or report an incorrect amount of entropy.

Decode the complete inline-length range and reject unsupported values.
Extended definite-length encodings retain their existing behavior, and
the existing size and INT_MAX checks continue to bound the returned
slice.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: b9873755a6 ("misc: Add Nitro Secure Module driver")
Assisted-by: unnamed:claude-opus-4.8 typestate
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
Link: https://patch.msgid.link/20260815151745.3758574-1-ruoyuw560@gmail.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Ruoyu Wang 2026-08-15 23:17:45 +08:00 committed by Greg Kroah-Hartman
parent e15596e84c
commit 6edddc1d10
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/misc/nsm.c
View File

@ -117,7 +117,7 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 **
array_len_p = &cbor_object[1];
switch (cbor_short_size) {
case CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */
case 0 ... CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */
array_len = cbor_short_size;
break;
case CBOR_LONG_SIZE_U8:
@ -132,6 +132,8 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 **
case CBOR_LONG_SIZE_U64:
array_len = be64_to_cpup((__be64 *)array_len_p);
break;
default:
return -EFAULT;
}
if (cbor_object_size < array_offset)