[PATCH] KEYS: asymmetric: fix OOB read in KEYCTL_PKEY_DECRYPT on zero-length message

[azraelxuemo <eilaimemedsnaimel@gmail.com>]

From: HanQuan <eilaimemedsnaimel@gmail.com>

In software_key_eds_op(), the condition

    if (!issig && ret == 0)
        ret = crypto_akcipher_maxsize(tfm);

replaces ret with the key size when crypto_akcipher_sync_decrypt()
returns 0.  This was added as a workaround for encrypt, where
crypto_akcipher_sync_encrypt() returns 0 on success (it lacks the
"?:" data.dlen" tail that sync_decrypt has).  However, for decrypt,
ret == 0 is legitimate: pkcs1pad_decrypt_complete() sets
req->dst_len = 0 for a zero-length PKCS#1 message, causing
crypto_akcipher_sync_decrypt() to return 0 via "0 ?: data.dlen".

When ret is replaced with maxsize, the caller keyctl_pkey_e_d_s()
does copy_to_user(_out, out, ret) with ret = key_size (e.g. 256
for RSA-2048) on a buffer allocated with kmalloc(params.out_len),
which can be as small as 1 byte.  This reads key_size - out_len
bytes beyond the allocation.

Restrict the maxsize substitution to the encrypt operation only,
where ret == 0 genuinely indicates success and the full key size
is the correct output length.

Fixes: 63ba4d67594a ("KEYS: asymmetric: Use new crypto interface without scatterlists")
Signed-off-by: HanQuan <eilaimemedsnaimel@gmail.com>
---
 crypto/asymmetric_keys/public_key.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index 09a0b83d5d77..2c3ac75ec92b 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -358,7 +358,10 @@ static int software_key_eds_op(struct kernel_pkey_params *params,
 		BUG();
 	}
 
-	if (!issig && ret == 0)
+	/* Decrypt may legitimately return 0 (zero-length message); only
+	 * replace ret with maxsize for encrypt, which returns 0 on success.
+	 */
+	if (!issig && ret == 0 && params->op == kernel_pkey_encrypt)
 		ret = crypto_akcipher_maxsize(tfm);
 
 error_free_tfm:
-- 
2.43.0