[PATCH v1 0/1] zcrypt crt and me fixes

[PATCH v1 0/1] zcrypt crt and me fixes

[Harald Freudenberger]

Fixes related to type50 and type6 with RSA CRT and ME.

Changelog:
v0: Just one patch fixes an AI finding with padding when a CRT
    CPRB for CCA cards is constructed. Details see patch header.

Harald Freudenberger (1):
  s390/zcrypt: Fix uninitialized padding in CRT key structure

 drivers/s390/crypto/zcrypt_cca_key.h | 1 +
 1 file changed, 1 insertion(+)

--
2.43.0

[PATCH v1 1/1] s390/zcrypt: Fix uninitialized padding in CRT key structure

[Harald Freudenberger]

The zcrypt_type6_crt_key() function leaves padding bytes uninitialized
between key components and the modulus in the CCA CRT key token. These
padding bytes are sent to the crypto card, potentially leaking kernel
memory contents.

The initial memset() only zeros fixed structure fields, not the
flexible array member key_parts[] where the padding resides. While key
components are properly copied from userspace, the calculated pad_len
bytes between them remain uninitialized.

Fix by explicitly zeroing the padding bytes after copying the CRT key
components.

Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
---
 drivers/s390/crypto/zcrypt_cca_key.h | 1 +
 1 file changed, 1 insertion(+)

diff --git a/drivers/s390/crypto/zcrypt_cca_key.h b/drivers/s390/crypto/zcrypt_cca_key.h
index f5907b67db29..8a69eed75040 100644
--- a/drivers/s390/crypto/zcrypt_cca_key.h
+++ b/drivers/s390/crypto/zcrypt_cca_key.h
@@ -219,6 +219,7 @@ static inline int zcrypt_type6_crt_key(struct ica_rsa_modexpo_crt *crt, void *p)
 	    copy_from_user(key->key_parts + 2 * long_len + 2 * short_len,
 			   crt->u_mult_inv, long_len))
 		return -EFAULT;
+	memset(key->key_parts + 3 * long_len + 2 * short_len, 0, pad_len);
 	memset(key->key_parts + 3 * long_len + 2 * short_len + pad_len,
 	       0xff, crt->inputdatalength);
 	pub = (struct cca_public_sec *)(key->key_parts + key_len);
-- 
2.43.0

Re: [PATCH v1 1/1] s390/zcrypt: Fix uninitialized padding in CRT key structure

[sashiko-bot]

> The zcrypt_type6_crt_key() function leaves padding bytes uninitialized
> between key components and the modulus in the CCA CRT key token. These
> padding bytes are sent to the crypto card, potentially leaking kernel
> memory contents.
> 
> The initial memset() only zeros fixed structure fields, not the
> flexible array member key_parts[] where the padding resides. While key
> components are properly copied from userspace, the calculated pad_len
> bytes between them remain uninitialized.
> 
> Fix by explicitly zeroing the padding bytes after copying the CRT key
> components.
> 
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260825160154.106501-2-freude@linux.ibm.com?part=1

Re: [PATCH v1 1/1] s390/zcrypt: Fix uninitialized padding in CRT key structure

[Finn Callies]

On 25.08.26 18:01, Harald Freudenberger wrote:
> The zcrypt_type6_crt_key() function leaves padding bytes uninitialized
> between key components and the modulus in the CCA CRT key token. These
> padding bytes are sent to the crypto card, potentially leaking kernel
> memory contents.
> 
> The initial memset() only zeros fixed structure fields, not the
> flexible array member key_parts[] where the padding resides. While key
> components are properly copied from userspace, the calculated pad_len
> bytes between them remain uninitialized.
> 
> Fix by explicitly zeroing the padding bytes after copying the CRT key
> components.
> 
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
> ---
>   drivers/s390/crypto/zcrypt_cca_key.h | 1 +
>   1 file changed, 1 insertion(+)
> 

[ snip ]

Reviewed-by: Finn Callies <fcallies@linux.ibm.com>

Re: [PATCH v1 0/1] zcrypt crt and me fixes

[Vasily Gorbik]

On Tue, Aug 25, 2026 at 06:01:53PM +0200, Harald Freudenberger wrote:
> Fixes related to type50 and type6 with RSA CRT and ME.
> 
> Changelog:
> v0: Just one patch fixes an AI finding with padding when a CRT
>     CPRB for CCA cards is constructed. Details see patch header.
> 
> Harald Freudenberger (1):
>   s390/zcrypt: Fix uninitialized padding in CRT key structure
> 
>  drivers/s390/crypto/zcrypt_cca_key.h | 1 +
>  1 file changed, 1 insertion(+)

Applied, thank you!