Re: [PATCH] misc: nsm: fix CBOR short-length decoding

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Fri, Aug 14, 2026 at 09:40:13PM +0800, Ruoyu Wang wrote:
> CBOR encodes byte-string lengths from 0 through 23 directly in the
> additional-information field. cbor_object_get_array() only handles 23,
> so shorter byte strings leave array_len uninitialized. Reserved values
> 28 through 30 and the unsupported indefinite-length encoding also fall
> through without assigning it.
> 
> parse_resp_get_random() then uses the indeterminate value for bounds
> checking and as the byte count returned to the hwrng core. This can
> reject a valid short response or report an incorrect amount of entropy.
> 
> Decode the complete inline-length range and reject unsupported values.
> Extended definite-length encodings retain their existing behavior, and
> the existing size and INT_MAX checks continue to bound the returned
> slice.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.

So shouldn't an Assisted-by: tag be correct to use here?

Same for your other patches.

thanks,

greg k-h