Received-SPF: pass (google.com: domain of linux-crypto-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <755e1dc9c777fa657ccd948f65f5f33240226c43.camel@huaweicloud.com>
Subject: Re: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
From:   Roberto Sassu <roberto.sassu@huaweicloud.com>
To:     Herbert Xu <herbert@gondor.apana.org.au>
Cc:     dhowells@redhat.com, davem@davemloft.net, zohar@linux.ibm.com,
        dmitry.kasatkin@gmail.com, paul@paul-moore.com, jmorris@namei.org,
        serge@hallyn.com, ebiggers@kernel.org,
        linux-integrity@vger.kernel.org,
        linux-security-module@vger.kernel.org, keyrings@vger.kernel.org,
        linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org,
        stable@vger.kernel.org
Date:   Mon, 16 Jan 2023 09:57:57 +0100
In-Reply-To: <Y7g7sp6UJJrYKihK@gondor.apana.org.au>
References: <20221227142740.2807136-1-roberto.sassu@huaweicloud.com>
         <20221227142740.2807136-2-roberto.sassu@huaweicloud.com>
         <Y7g7sp6UJJrYKihK@gondor.apana.org.au>
Content-Type: text/plain; charset="UTF-8"
User-Agent: Evolution 3.36.5-0ubuntu1 
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Fri, 2023-01-06 at 23:18 +0800, Herbert Xu wrote:
> On Tue, Dec 27, 2022 at 03:27:39PM +0100, Roberto Sassu wrote:
> > From: Herbert Xu <herbert@gondor.apana.org.au>
> > 
> > The helper mpi_read_raw_from_sgl sets the number of entries in
> > the SG list according to nbytes.  However, if the last entry
> > in the SG list contains more data than nbytes, then it may overrun
> > the buffer because it only allocates enough memory for nbytes.
> > 
> > Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers")
> > Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com>
> > Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> > ---
> >  lib/mpi/mpicoder.c | 3 ++-
> >  1 file changed, 2 insertions(+), 1 deletion(-)
> 
> Patch applied.  Thanks.

Hi Herbert

will you take also the second patch?

Thanks

Roberto