Messages in this thread | | | Date | Fri, 22 Jul 2022 08:22:07 +0200 | Subject | Re: [PATCH 1/2] nvme-auth: Fix off by one checks | From | Hannes Reinecke <> |
| |
On 7/18/22 13:09, Dan Carpenter wrote: > The > ARRAY_SIZE() checks need to be >= ARRAY_SIZE() to prevent reading > one element beyond the end of the arrays. > > Fixes: a476416bb57b ("nvme: implement In-Band authentication") > Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com> > --- > The MAINTAINERS file needs to be updated for this new code. > > drivers/nvme/common/auth.c | 10 +++++----- > 1 file changed, 5 insertions(+), 5 deletions(-) > > diff --git a/drivers/nvme/common/auth.c b/drivers/nvme/common/auth.c > index 0c86ebce59d2..bfb16fec0aed 100644 > --- a/drivers/nvme/common/auth.c > +++ b/drivers/nvme/common/auth.c > @@ -55,7 +55,7 @@ static struct nvme_auth_dhgroup_map { > > const char *nvme_auth_dhgroup_name(u8 dhgroup_id) > { > - if ((dhgroup_id > ARRAY_SIZE(dhgroup_map)) || > + if ((dhgroup_id >= ARRAY_SIZE(dhgroup_map)) || > !dhgroup_map[dhgroup_id].name || > !strlen(dhgroup_map[dhgroup_id].name)) > return NULL; > @@ -65,7 +65,7 @@ EXPORT_SYMBOL_GPL(nvme_auth_dhgroup_name); > > const char *nvme_auth_dhgroup_kpp(u8 dhgroup_id) > { > - if ((dhgroup_id > ARRAY_SIZE(dhgroup_map)) || > + if ((dhgroup_id >= ARRAY_SIZE(dhgroup_map)) || > !dhgroup_map[dhgroup_id].kpp || > !strlen(dhgroup_map[dhgroup_id].kpp)) > return NULL; > @@ -113,7 +113,7 @@ static struct nvme_dhchap_hash_map { > > const char *nvme_auth_hmac_name(u8 hmac_id) > { > - if ((hmac_id > ARRAY_SIZE(hash_map)) || > + if ((hmac_id >= ARRAY_SIZE(hash_map)) || > !hash_map[hmac_id].hmac || > !strlen(hash_map[hmac_id].hmac)) > return NULL; > @@ -123,7 +123,7 @@ EXPORT_SYMBOL_GPL(nvme_auth_hmac_name); > > const char *nvme_auth_digest_name(u8 hmac_id) > { > - if ((hmac_id > ARRAY_SIZE(hash_map)) || > + if ((hmac_id >= ARRAY_SIZE(hash_map)) || > !hash_map[hmac_id].digest || > !strlen(hash_map[hmac_id].digest)) > return NULL; > @@ -148,7 +148,7 @@ EXPORT_SYMBOL_GPL(nvme_auth_hmac_id); > > size_t nvme_auth_hmac_hash_len(u8 hmac_id) > { > - if ((hmac_id > ARRAY_SIZE(hash_map)) || > + if ((hmac_id >= ARRAY_SIZE(hash_map)) || > !hash_map[hmac_id].hmac || > !strlen(hash_map[hmac_id].hmac)) > return 0;
Reviewed-by: Hannes Reinecke <hare@suse.de>
Cheers,
Hannes -- Dr. Hannes Reinecke Kernel Storage Architect hare@suse.de +49 911 74053 688 SUSE Software Solutions GmbH, Maxfeldstr. 5, 90409 Nürnberg HRB 36809 (AG Nürnberg), Geschäftsführer: Ivo Totev, Andrew Myers, Andrew McDonald, Martje Boudien Moerman
| |