Re: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Subject: Re: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
From: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Date: Fri, 30 Dec 2022 23:39:30 +0800
Cc: "'Roberto Sassu'" <roberto.sassu@xxxxxxxxxxxxxxx>, "dhowells@xxxxxxxxxx" <dhowells@xxxxxxxxxx>, "davem@xxxxxxxxxxxxx" <davem@xxxxxxxxxxxxx>, "zohar@xxxxxxxxxxxxx" <zohar@xxxxxxxxxxxxx>, "dmitry.kasatkin@xxxxxxxxx" <dmitry.kasatkin@xxxxxxxxx>, "paul@xxxxxxxxxxxxxx" <paul@xxxxxxxxxxxxxx>, "jmorris@xxxxxxxxx" <jmorris@xxxxxxxxx>, "serge@xxxxxxxxxx" <serge@xxxxxxxxxx>, "ebiggers@xxxxxxxxxx" <ebiggers@xxxxxxxxxx>, "linux-integrity@xxxxxxxxxxxxxxx" <linux-integrity@xxxxxxxxxxxxxxx>, "linux-security-module@xxxxxxxxxxxxxxx" <linux-security-module@xxxxxxxxxxxxxxx>, "keyrings@xxxxxxxxxxxxxxx" <keyrings@xxxxxxxxxxxxxxx>, "linux-crypto@xxxxxxxxxxxxxxx" <linux-crypto@xxxxxxxxxxxxxxx>, "linux-kernel@xxxxxxxxxxxxxxx" <linux-kernel@xxxxxxxxxxxxxxx>, "stable@xxxxxxxxxxxxxxx" <stable@xxxxxxxxxxxxxxx>
In-reply-to: <6949ced7c1014488b2d00ff26eba6b6b@AcuMS.aculab.com>

On Fri, Dec 30, 2022 at 01:35:07PM +0000, David Laight wrote:
>
> miter.length is size_t (unsigned long on 64bit) and nbytes unsigned int.

miter.length is bounded by sg->length which is unsigned int.

Cheers,
-- 
Email: Herbert Xu <herbert@xxxxxxxxxxxxxxxxxxx>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Follow-Ups:
- RE: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
  - From: David Laight

References:
- [PATCH v5 0/2] KEYS: asymmetric: Copy sig and digest in public_key_verify_signature()
  - From: Roberto Sassu
- [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
  - From: Roberto Sassu
- RE: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
  - From: David Laight

Prev by Date: RE: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
Next by Date: Re: [PATCH 001/606] tpm: st33zp24: Convert to Convert to i2c's .probe_new()
Previous by thread: RE: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
Next by thread: RE: [PATCH v5 1/2] lib/mpi: Fix buffer overrun when SG is too long
Index(es):
- Date
- Thread

[Index of Archives] [Linux Kernel] [Linux Kernel Hardening] [Linux NFS] [Linux NILFS] [Linux USB Devel] [Video for Linux] [Linux Audio Users] [Yosemite News] [Linux SCSI]