Received: by 2002:a6b:500f:0:0:0:0:0 with SMTP id e15csp1937395iob; Thu, 5 May 2022 11:16:45 -0700 (PDT) X-Google-Smtp-Source: ABdhPJxoX856iE22GDxYpBKOwPlVzBCGPnupjDiG4XXssJihqfUInbxjm8//CA34aa/I2g+xHJ8n X-Received: by 2002:a17:90a:cd01:b0:1db:d42b:f3df with SMTP id d1-20020a17090acd0100b001dbd42bf3dfmr7538359pju.17.1651774605354; Thu, 05 May 2022 11:16:45 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1651774605; cv=none; d=google.com; s=arc-20160816; b=G2B73aGlZpGA5Nf5tFNJX8ht4tsBVbBmj61IOpnCgFJFu+5Xh1GQ7vqgmhFcdbSzAh n9wGFH67pMAiZGCaEWKBidzFBdh1do8ImtqEnDo3MVkuB7pK9tr9F+8uZD/ODjsAD61b QUF03b409daIc2ctO7kWicLsAMf1rBV7wlz6YidLHg+QVUWa3wU8c09YD+ciSLvKRzZO F/ExH4fyb8lhC4HbaPanAM9TF/JqYPg1w+23FNNdvbxKkqNjBpb2soPfpIr2fgvVAE+p Pw2oML7dYbkTsAadzWCY1rfp/UdwZUGUCV3+iJfgkIxKNSjO84WAMshSHl0b6kpyS+Ez pu+A== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :user-agent:references:in-reply-to:message-id:date:subject:cc:to :from:dkim-signature; bh=gf1HHdqHUd672dNLSZlWTc3P/aQGVhVSG6NMJlWMUC8=; b=mBCNepKlBemd0XJLi2uA3+q8qar/+yZPllr7FaAe6+t5tD7EGEGhiEsYJVNXW/gaLg auhrwCMUuJIAemh77HArHOO9TnwUn7ftXlawzOa319FL2BjxWIBaJbx8TG+ceTUdq1IE ANRzzIDeifiYrFJhBcGSMFVX3sS5tjRiqeAhTB4thIVnbLPRialBh+hgmCfqDHLft0W9 HGblmYP+P/jMZ3UE881g/q+IyYWSLPpTfme6rYAFh13eGc/sl+E8Oa+6oZ+7POtLc8l/ ftsdqt9Fe9QIaCYEtJcLqOmFWeF9yZ5hb9mcy09EF1kKPpmFnpeU3wjV4SGjo0TrhSBc 4Cqg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=UAucvXpY; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Return-Path: Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id v28-20020aa799dc000000b0050d8ac9c429si2264798pfi.101.2022.05.05.11.16.28; Thu, 05 May 2022 11:16:45 -0700 (PDT) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@linuxfoundation.org header.s=korg header.b=UAucvXpY; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linuxfoundation.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1356703AbiEDRiT (ORCPT + 99 others); Wed, 4 May 2022 13:38:19 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:39888 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1356855AbiEDRJq (ORCPT ); Wed, 4 May 2022 13:09:46 -0400 Received: from dfw.source.kernel.org (dfw.source.kernel.org [IPv6:2604:1380:4641:c500::1]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id E34AA41325; Wed, 4 May 2022 09:56:01 -0700 (PDT) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id C491A61851; Wed, 4 May 2022 16:56:01 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 1C95AC385A5; Wed, 4 May 2022 16:56:01 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1651683361; bh=+J6mkW7g7FZT8T1bJ9fP3KdetTDCgArgqcBdHrc4ShY=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=UAucvXpYbpmvldG4iJ0xOw/Z3wwLfeQgKaqJB/fFYRENh88UATYFpRm33KNZDKrNN JMUOTcZCnTZd2h+tRRzu+Uj6GyNb88iKN1ZFvY6tyjG4wvas07Ms/a5O0w0RS1amRv bEuxTa3BlhZm6MouXBNpNWPHjIvKTd4CI0kkLZpk= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Mikulas Patocka , Andy Shevchenko , Linus Torvalds Subject: [PATCH 5.17 048/225] hex2bin: fix access beyond string end Date: Wed, 4 May 2022 18:44:46 +0200 Message-Id: <20220504153114.387555140@linuxfoundation.org> X-Mailer: git-send-email 2.36.0 In-Reply-To: <20220504153110.096069935@linuxfoundation.org> References: <20220504153110.096069935@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Spam-Status: No, score=-7.7 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_HI, SPF_HELO_NONE,SPF_PASS,T_SCC_BODY_TEXT_LINE autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Mikulas Patocka commit e4d8a29997731b3bb14059024b24df9f784288d0 upstream. If we pass too short string to "hex2bin" (and the string size without the terminating NUL character is even), "hex2bin" reads one byte after the terminating NUL character. This patch fixes it. Note that hex_to_bin returns -1 on error and hex2bin return -EINVAL on error - so we can't just return the variable "hi" or "lo" on error. This inconsistency may be fixed in the next merge window, but for the purpose of fixing this bug, we just preserve the existing behavior and return -1 and -EINVAL. Signed-off-by: Mikulas Patocka Reviewed-by: Andy Shevchenko Fixes: b78049831ffe ("lib: add error checking to hex2bin") Cc: stable@vger.kernel.org Signed-off-by: Linus Torvalds Signed-off-by: Greg Kroah-Hartman --- lib/hexdump.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) --- a/lib/hexdump.c +++ b/lib/hexdump.c @@ -63,10 +63,13 @@ EXPORT_SYMBOL(hex_to_bin); int hex2bin(u8 *dst, const char *src, size_t count) { while (count--) { - int hi = hex_to_bin(*src++); - int lo = hex_to_bin(*src++); + int hi, lo; - if ((hi < 0) || (lo < 0)) + hi = hex_to_bin(*src++); + if (unlikely(hi < 0)) + return -EINVAL; + lo = hex_to_bin(*src++); + if (unlikely(lo < 0)) return -EINVAL; *dst++ = (hi << 4) | lo;