[PATCH] misc: nsm: fix CBOR short-length decoding

[PATCH] misc: nsm: fix CBOR short-length decoding

[Ruoyu Wang]

CBOR encodes byte-string lengths from 0 through 23 directly in the
additional-information field. cbor_object_get_array() only handles 23,
so shorter byte strings leave array_len uninitialized. Reserved values
28 through 30 and the unsupported indefinite-length encoding also fall
through without assigning it.

parse_resp_get_random() then uses the indeterminate value for bounds
checking and as the byte count returned to the hwrng core. This can
reject a valid short response or report an incorrect amount of entropy.

Decode the complete inline-length range and reject unsupported values.
Extended definite-length encodings retain their existing behavior, and
the existing size and INT_MAX checks continue to bound the returned
slice.

This issue was found by a static analysis checker and confirmed by
manual source review.

Fixes: b9873755a6c8 ("misc: Add Nitro Secure Module driver")
Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
---
 drivers/misc/nsm.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/misc/nsm.c b/drivers/misc/nsm.c
index ef7b327423409..ad4723f4dc452 100644
--- a/drivers/misc/nsm.c
+++ b/drivers/misc/nsm.c
@@ -117,7 +117,7 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 **
 	array_len_p = &cbor_object[1];
 
 	switch (cbor_short_size) {
-	case CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */
+	case 0 ... CBOR_SHORT_SIZE_MAX_VALUE: /* short encoding */
 		array_len = cbor_short_size;
 		break;
 	case CBOR_LONG_SIZE_U8:
@@ -132,6 +132,8 @@ static int cbor_object_get_array(u8 *cbor_object, size_t cbor_object_size, u8 **
 	case CBOR_LONG_SIZE_U64:
 		array_len = be64_to_cpup((__be64 *)array_len_p);
 		break;
+	default:
+		return -EFAULT;
 	}
 
 	if (cbor_object_size < array_offset)
-- 
2.51.0

Re: [PATCH] misc: nsm: fix CBOR short-length decoding

[Greg Kroah-Hartman]

On Fri, Aug 14, 2026 at 09:40:13PM +0800, Ruoyu Wang wrote:
> CBOR encodes byte-string lengths from 0 through 23 directly in the
> additional-information field. cbor_object_get_array() only handles 23,
> so shorter byte strings leave array_len uninitialized. Reserved values
> 28 through 30 and the unsupported indefinite-length encoding also fall
> through without assigning it.
> 
> parse_resp_get_random() then uses the indeterminate value for bounds
> checking and as the byte count returned to the hwrng core. This can
> reject a valid short response or report an incorrect amount of entropy.
> 
> Decode the complete inline-length range and reject unsupported values.
> Extended definite-length encodings retain their existing behavior, and
> the existing size and INT_MAX checks continue to bound the returned
> slice.
> 
> This issue was found by a static analysis checker and confirmed by
> manual source review.

So shouldn't an Assisted-by: tag be correct to use here?

Same for your other patches.

thanks,

greg k-h