lib/mpi: Fix buffer overrun when SG is too long

[ Upstream commit 7361d1bc307b926cbca214ab67b641123c2d6357 ]

The helper mpi_read_raw_from_sgl sets the number of entries in
the SG list according to nbytes.  However, if the last entry
in the SG list contains more data than nbytes, then it may overrun
the buffer because it only allocates enough memory for nbytes.

Fixes: ebd84f3efad6 ("lib/mpi: Add mpi sgl helpers")
Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Reviewed-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index eead4b339466854f51db30a17f17ee0472ebe6d3..4f73db248009e8b867b413ba42bb6013c895c569 100644 (file)
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -397,7 +397,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
 
        while (sg_miter_next(&miter)) {
                buff = miter.addr;
-               len = miter.length;
+               len = min_t(unsigned, miter.length, nbytes);
+               nbytes -= len;
 
                for (x = 0; x < len; x++) {
                        a <<= 8;