From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1754356AbdCTOZ4 (ORCPT ); Mon, 20 Mar 2017 10:25:56 -0400 Received: from youngberry.canonical.com ([91.189.89.112]:35363 "EHLO youngberry.canonical.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753285AbdCTOYR (ORCPT ); Mon, 20 Mar 2017 10:24:17 -0400 From: Colin King To: Peter Huewe , Marcel Selhorst , Jarkko Sakkinen , Jason Gunthorpe , tpmdd-devel@lists.sourceforge.net Cc: kernel-janitors@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [PATCH] tpm2: fix off-by-one comparison and out-of-bounds read error Date: Mon, 20 Mar 2017 14:23:36 +0000 Message-Id: <20170320142336.10997-1-colin.king@canonical.com> X-Mailer: git-send-email 2.11.0 MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Colin Ian King The comparison of an out of range index into space->context_tbl is off-by-one and should be using >= rather than > in the comparison. Detected by CoverityScan, CID#1419694 ("Out-of-bounds read") Fixes: 849246e7ce9ce ("tpm2: add session handle context saving and restoring to the space code") Signed-off-by: Colin Ian King --- drivers/char/tpm/tpm2-space.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/tpm/tpm2-space.c b/drivers/char/tpm/tpm2-space.c index d36d81e07076..009934269514 100644 --- a/drivers/char/tpm/tpm2-space.c +++ b/drivers/char/tpm/tpm2-space.c @@ -229,7 +229,7 @@ static bool tpm2_map_to_phandle(struct tpm_space *space, void *handle) int i; i = 0xFFFFFF - (vhandle & 0xFFFFFF); - if (i > ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) + if (i >= ARRAY_SIZE(space->context_tbl) || !space->context_tbl[i]) return false; phandle = space->context_tbl[i]; -- 2.11.0