Re: [PATCH] crypto: qat - validate RSA CRT component lengths

[Herbert Xu <herbert@gondor.apana.org.au>]

On Thu, May 28, 2026 at 04:57:44PM +0100, Giovanni Cabiddu wrote:
> The generic RSA key parser (rsa_helper.c) bounds each CRT component (p,
> q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt()
> allocates half-size DMA buffers (key_sz / 2) and right-aligns each
> component with:
> 
>     memcpy(dst + half_key_sz - len, src, len)
> 
> When a CRT component is larger than half_key_sz the subtraction
> underflows and memcpy writes past the DMA buffer, causing memory
> corruption.
> 
> Add a len > half_key_sz check next to the existing !len check for each
> of the five CRT components so the driver falls back to the non-CRT path
> instead of writing out of bounds.
> 
> Fixes: 879f77e9071f ("crypto: qat - Add RSA CRT mode")
> Cc: stable@vger.kernel.org
> Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com>
> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com>
> Reviewed-by: Laurent M Coquerel <laurent.m.coquerel@intel.com>
> Tested-by: Laurent M Coquerel <laurent.m.coquerel@intel.com>
> ---
>  drivers/crypto/intel/qat/qat_common/qat_asym_algs.c | 10 +++++-----
>  1 file changed, 5 insertions(+), 5 deletions(-)

Patch applied.  Thanks.
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt