Re: [PATCH 1/2] KEYS: fix signature length passed to KEYCTL_PKEY_VERIFY

[sashiko-bot@kernel.org]

> From: Florian Bauckholt <florian.bauckholt@cispa.de>
> 
> Commit cb481e59ea6c ("KEYS: fix overflow in keyctl_pkey_params_get_2()")
> made keyctl_pkey_params_get_2() set params->out_len to the maximum
> output size of the operation instead of the size provided by the caller.
> It does so for KEYCTL_PKEY_VERIFY as well, but verify has no output
> buffer: out_len shares a union with in2_len, the length of the
> signature.
> 
> As a result keyctl_pkey_verify() ignores the signature length passed by
> the caller. It copies max_sig_size bytes from the signature pointer and
> passes max_sig_size as the signature size to the verification.
> 
> This makes no difference for signatures that are always max_sig_size
> bytes long, such as RSA. A shorter signature, e.g. a DER-encoded ECDSA
> signature, is followed by whatever is behind it in the caller's memory,
> or the call fails with -EFAULT if that memory is not readable. The
> x962 ECDSA template currently ignores data following the signature,
> which hides the problem.
> 
> Use the length provided by the caller, which has already been checked
> against max_sig_size.
> 
> Fixes: cb481e59ea6c ("KEYS: fix overflow in keyctl_pkey_params_get_2()")
> Cc: stable@vger.kernel.org
> Link: https://lore.kernel.org/all/20260919221742.3709658-1-benquike@gmail.com/
> Signed-off-by: Florian Bauckholt <florian.bauckholt@cispa.de>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261111-keyctl-pkey-fixes-v1-0-934ebaa267a7@cispa.de?part=1