From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 5E8432222CC for ; Sat, 15 Aug 2026 04:51:56 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786769517; cv=none; b=PE9sWACRAzXqDN6jo2r9svoEYoK1jFuNkhfY4MK8/69sxuQoxysWvkzsvflFy1PyX9O6mMSVOcnXIyRs9th91nIMlqAwfNNhHVvRK2TYEsIMz8kDlm/LHJShXRtAHp4kFSBJKBBKCw8nxG6jTwJov/G6xBynEvuJ4MKkUGcgGRs= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786769517; c=relaxed/simple; bh=EQjh/tnLZGMvBYy0DLBxnSvS9oUFdPdmCThdy3Xe5TU=; h=Date:From:To:Cc:Subject:Message-ID:References:MIME-Version: Content-Type:Content-Disposition:In-Reply-To; b=H67QcsVONL7+M0Ot8jhPL5ag22+7Nib0h18PW2d/qAYXIyPq22kMLO18b6sWUuYjlroo75fFWS1WMU8aBphJBL6Tqf0WOCGkYQNTWoL6LeHVVbvbq/Uar2PrdYl0bAoM9ILLs2A1KxWkkJIR4y67gQ6ZYuHKeFyFI6z2bO1PilA= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=PJwaSLZ0; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="PJwaSLZ0" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 528FE1F000E9; Sat, 15 Aug 2026 04:51:55 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1786769515; bh=hESH7GIVVTNw9NfUoZ7Fp52DcncaYFV2bLdHSVSWCYM=; h=Date:From:To:Cc:Subject:References:In-Reply-To; b=PJwaSLZ0LEZMLV2UqZMInsLtzgbaV8vvorR7s9WQu98CcWt2rcu/WrZrsQK42ca2O xWvSq3KNg13Acsm60TWE1Q35xprXDFFqvbRij2l3bgtuQ90AiD3kET/CEXiDh8hulV ISwj0TjJ7wButFePsT3dxKcEaq56tgQB1hNIIPXQ= Date: Sat, 15 Aug 2026 13:50:20 +0900 From: Greg Kroah-Hartman To: Ruoyu Wang Cc: Alexander Graf , The AWS Nitro Enclaves Team , Arnd Bergmann , linux-kernel@vger.kernel.org Subject: Re: [PATCH] misc: nsm: fix CBOR short-length decoding Message-ID: <2026081500-reliable-unfrosted-fccf@gregkh> References: <20260814134013.1386522-1-ruoyuw560@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20260814134013.1386522-1-ruoyuw560@gmail.com> On Fri, Aug 14, 2026 at 09:40:13PM +0800, Ruoyu Wang wrote: > CBOR encodes byte-string lengths from 0 through 23 directly in the > additional-information field. cbor_object_get_array() only handles 23, > so shorter byte strings leave array_len uninitialized. Reserved values > 28 through 30 and the unsupported indefinite-length encoding also fall > through without assigning it. > > parse_resp_get_random() then uses the indeterminate value for bounds > checking and as the byte count returned to the hwrng core. This can > reject a valid short response or report an incorrect amount of entropy. > > Decode the complete inline-length range and reject unsupported values. > Extended definite-length encodings retain their existing behavior, and > the existing size and INT_MAX checks continue to bound the returned > slice. > > This issue was found by a static analysis checker and confirmed by > manual source review. So shouldn't an Assisted-by: tag be correct to use here? Same for your other patches. thanks, greg k-h