lib/mpi: Fix buffer overrun when SG is too long

The helper mpi_read_raw_from_sgl sets the number of entries in
the SG list according to nbytes.  However, if the last entry
in the SG list contains more data than nbytes, then it may overrun
the buffer because it only allocates enough memory for nbytes.

Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers")
Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index 39c4c67310946f0fa3fb96fd3b8ae79cf3fe4b97..3cb6bd148fa9e38e8634c592abb8bd85e142c480 100644 (file)
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
 
        while (sg_miter_next(&miter)) {
                buff = miter.addr;
-               len = miter.length;
+               len = min_t(unsigned, miter.length, nbytes);
+               nbytes -= len;
 
                for (x = 0; x < len; x++) {
                        a <<= 8;