From 6edddc1d101bfd5cafc94ca2dffaf13e4394662d Mon Sep 17 00:00:00 2001 From: Ruoyu Wang Date: Sat, 15 Aug 2026 23:17:45 +0800 Subject: [PATCH] misc: nsm: fix CBOR short-length decoding CBOR encodes byte-string lengths from 0 through 23 directly in the additional-information field. cbor_object_get_array() only handles 23, so shorter byte strings leave array_len uninitialized. Reserved values 28 through 30 and the unsupported indefinite-length encoding also fall through without assigning it. parse_resp_get_random() then uses the indeterminate value for bounds checking and as the byte count returned to the hwrng core. This can reject a valid short response or report an incorrect amount of entropy. Decode the complete inline-length range and reject unsupported values. Extended definite-length encodings retain their existing behavior, and the existing size and INT_MAX checks continue to bound the returned slice. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver") Assisted-by: unnamed:claude-opus-4.8 typestate Signed-off-by: Ruoyu Wang Link: https://patch.msgid.link/20260815151745.3758574-1-ruoyuw560@gmail.com Signed-off-by: Greg Kroah-Hartman --- drivers/misc/nsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c index f1bdde2b77e1..b6d3fa79a5e8 100644 --- a/drivers/misc/nsm.c +++ b/drivers/misc/nsm.c @@ -117,7 +117,7 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 ** array_len_p = &cbor_object[1]; switch (cbor_short_size) { - case CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */ + case 0 ... CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */ array_len = cbor_short_size; break; case CBOR_LONG_SIZE_U8: @@ -132,6 +132,8 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 ** case CBOR_LONG_SIZE_U64: array_len = be64_to_cpup((__be64 *)array_len_p); break; + default: + return -EFAULT; } if (cbor_object_size < array_offset)