On 12/20/2022 8:24 AM, Herbert Xu wrote:
On Mon, Dec 19, 2022 at 09:49:29AM +0100, Roberto Sassu wrote:
do you have any news on this bug?
Thanks for the reminder. Could you please try this patch?
Tried, could not boot the UML kernel.
After looking, it seems we have to call sg_miter_stop(). Or
alternatively, we could let sg_miter_next() be called but not writing
anything inside the loop.
With either of those fixes, the tests pass (using one scatterlist).
Roberto
---8<---
The helper mpi_read_raw_from_sgl ignores the second parameter
nbytes when reading the SG list and may overrun its own buffer
because it only allocates enough memory according to nbytes.
Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers")
Reported-by: Roberto Sassu <roberto.sassu@xxxxxxxxxxxxxxx>
Signed-off-by: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index 39c4c6731094..6bffc68c1a5a 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -494,17 +494,15 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
val->sign = 0;
val->nlimbs = nlimbs;
- if (nbytes == 0)
- return val;
-
j = nlimbs - 1;
a = 0;
z = BYTES_PER_MPI_LIMB - nbytes % BYTES_PER_MPI_LIMB;
z %= BYTES_PER_MPI_LIMB;
- while (sg_miter_next(&miter)) {
+ while (nbytes && sg_miter_next(&miter)) {
buff = miter.addr;
- len = miter.length;
+ len = min_t(unsigned, miter.length, nbytes);
+ nbytes -= len;
for (x = 0; x < len; x++) {
a <<= 8;
