From nobody Fri Aug 14 15:49:23 2026 Received: from mail-pj1-f52.google.com (mail-pj1-f52.google.com [209.85.216.52]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 97BE74749FC for ; Fri, 14 Aug 2026 13:40:20 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.52 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714822; cv=none; b=ZeKxPBJcvJ9XVcZgGXbs8kVdmKqu2ECuQo3rmmZw7oG12WXNQbkVLNGvSeJi+MWBjFnN9d8KCEcWp2HfDHl0QL1vTirRzUK9BmS2ExSe2v+6VM8tnZ4hjreOYyZ/y/3KA1hypGFdZP73WjNMbIZWps/6GQuVNu6g1FvEYM5la7M= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786714822; c=relaxed/simple; bh=BsbCFAVl6gxrzuOef09p5CZTwozjqB624VGairaQWJE=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=GEm7bx/RZBRJKf8kJcrOzwwYMfOReboEwNh0nNCxmmBY3q+cRWfHrW6nLKacrnAGY1v7Ft55/5mjJ6Gca54Eho67yqKDc7B2vzv16+L59924+V2O+J64gyMIlsxlBkFWc1oHFxYqNGifMZGzmX3BGtIW+rc0zu44rYuI9ypluq4= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=VBovnpAV; arc=none smtp.client-ip=209.85.216.52 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="VBovnpAV" Received: by mail-pj1-f52.google.com with SMTP id 98e67ed59e1d1-38e42560ebcso859209a91.1 for ; Fri, 14 Aug 2026 06:40:20 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786714820; x=1787319620; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=yKVfsBCLHjaCnugraLU/D/dWudJp4Nzo8u/AU7GCpBE=; b=VBovnpAV4x3UtoMROn6d5qdIuGsL63tH0SwP/b+n7bYTkdHDmT9A7ZREtjsTD50PgI SyoSZLFZ6sHP6dUJRbcq7QZwA/ymDib5AVybjxe3ZU088dNp8r9T839UPCP/XoeVMt0q s2vGeYY8AtDDL1puZB0RFXh+fqIQKwoQoqUxX4Mymfv6Gw/dG20uinNElDE7PdB/rcad K1JX7TMH9HRvxWFdHqKeCddp+cQQHZHu5M9gACYoXGct5eVIeVLy5TYhjDWGMYppekn2 EV7OaAcan7Rl6ONSiHblfE7zs38NADTM9369HRXhv6QSTdMUGOdtgKb+q6ZYmMW26P4g 7sbA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786714820; x=1787319620; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=yKVfsBCLHjaCnugraLU/D/dWudJp4Nzo8u/AU7GCpBE=; b=CA9o0Xptc4hWfrjL8rMWemn5x+Ju2zYW2NOeJmiFpiEWb2Y4ceDznkpi7hVntEpopl UYfApOxFoa3Hh4oUWyyH21dpZUOs9etkqj8QSPDZNqiblnLwSC5BiUWqHIbHwPFoSM04 079DA3CyRm8vzqE6XjAKdj0PwtDo7GbBPLwnRnRDAPuWeU7+wqBtb7i+WoNO2pkmIMwR wHnEnuxTkfTcrnVOM9vaghEi+AHZR5lkM7oeChkdmmg32waydLrLK/UXK1BRadKJw+Qc 8cFZm/zap6larbyk+to5uI1Fa/YVWIEl1EFjh7WJ4zUqMyAx9F5EcxQKSPFODWUNNj/r Ms6g== X-Gm-Message-State: AOJu0YwwN8bEJpj1o4KxezNxtQWQyGmcYye9cH8KWIRGAToCG9cu/qYs 5VYiw7U7KuTxhRnI6l5KwlsntRixdHIvROw+208ZXBBNfyv1wTplmeHI X-Gm-Gg: AR+sD13+hwgKvumv2CSa6Em3XyQVhfx9U0tI464tZClu1/45UnQlbXz591c47KfqIXq w6Azbpn94svrJzwZDNvNE0ZHcYwt5ZMM2Vnd+bG0/7gkVra1KgV/qPrO29TztAJdhyGkl6fZk8H eWzJebqFOU2w9efxPC7692tC4YB0FxhdWpmQHX6bXa+pld28YgKYKwXZ9NucE0uutWqiAUXiJK0 McNtzYsC5URDz0KkF6lxxjXsslVMdUaCnlEMqyrsx3pjJLXZtfbPpUPevFQuVgA2sXqOFdV0qBh WN5md9QqKU4C06l1r+lmhMdHeroggD8xq9BEq+YUmrgbwHsvSuDec/JI1FFjjFE6tvHp/Ju8LrL I1brNCxslhnIdYXJizH3PMm1rqCfGeRPKoV4DM+SpIKQGy4bRPekxTjGSDuvuIaJVPFbUHiC2NK 0xiAfsAgnK8S27qjmO8lsvmoy3gAxZrZVSG+q5rZw20BnIwWiBg/f/uGVnEbj7NAsYJqR3QYcl6 0uTKeyo X-Received: by 2002:a17:90b:2891:b0:38e:7168:281 with SMTP id 98e67ed59e1d1-3933b916f3fmr6287365a91.10.1786714819654; Fri, 14 Aug 2026 06:40:19 -0700 (PDT) Received: from haichao.tail057a43.ts.net ([2001:da8:e000:1206:e9af:7c0e:be31:2c3f]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-394ea995222sm2975037a91.6.2026.08.14.06.40.17 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Fri, 14 Aug 2026 06:40:19 -0700 (PDT) From: Ruoyu Wang To: Alexander Graf , The AWS Nitro Enclaves Team , Arnd Bergmann , Greg Kroah-Hartman Cc: linux-kernel@vger.kernel.org, Ruoyu Wang Subject: [PATCH] misc: nsm: fix CBOR short-length decoding Date: Fri, 14 Aug 2026 21:40:13 +0800 Message-ID: <20260814134013.1386522-1-ruoyuw560@gmail.com> X-Mailer: git-send-email 2.51.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" CBOR encodes byte-string lengths from 0 through 23 directly in the additional-information field. cbor_object_get_array() only handles 23, so shorter byte strings leave array_len uninitialized. Reserved values 28 through 30 and the unsupported indefinite-length encoding also fall through without assigning it. parse_resp_get_random() then uses the indeterminate value for bounds checking and as the byte count returned to the hwrng core. This can reject a valid short response or report an incorrect amount of entropy. Decode the complete inline-length range and reject unsupported values. Extended definite-length encodings retain their existing behavior, and the existing size and INT_MAX checks continue to bound the returned slice. This issue was found by a static analysis checker and confirmed by manual source review. Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver") Signed-off-by: Ruoyu Wang --- drivers/misc/nsm.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c index ef7b327423409..ad4723f4dc452 100644 --- a/drivers/misc/nsm.c +++ b/drivers/misc/nsm.c @@ -117,7 +117,7 @@ static int cbor_object_get_array(u8 *cbor_object, size_= t cbor_object_size, u8 ** array_len_p =3D &cbor_object[1]; =20 switch (cbor_short_size) { - case CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */ + case 0 ... CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */ array_len =3D cbor_short_size; break; case CBOR_LONG_SIZE_U8: @@ -132,6 +132,8 @@ static int cbor_object_get_array(u8 *cbor_object, size_= t cbor_object_size, u8 ** case CBOR_LONG_SIZE_U64: array_len =3D be64_to_cpup((__be64 *)array_len_p); break; + default: + return -EFAULT; } =20 if (cbor_object_size < array_offset) --=20 2.51.0