Re: [v2 PATCH] crypto: algif_aead - Fix minimum RX size check for decryption

[Daniel Pouzzner <douzzer@mega.nu>]

Hooray, all clean with this, on all impacted test scenarios.  Thanks Herbert! 
And made it into v7.0 with over 5 hours to spare :-)

On Sun, 2026-04-12 at 13:32 +0800, Herbert Xu wrote:
> On Fri, Apr 10, 2026 at 10:33:39AM -0500, Daniel Pouzzner wrote:
> > 
> > Meanwhile, next-20260409 with your point patches to
> > crypto/algif_aead.c:_aead_recvmsg() and crypto/af_alg.c:af_alg_pull_tsgl()
> > deterministically produces wrong results on these:
> > 
> > [FAILED: 64-bit - 7.1.0-rc7-next-next-20260409-dirty] AEAD ccm(aes) asynchronous one shot multiple test
> > (/usr/local/libexec/libkcapi/kcapi  -d 4 -x 10   -c ccm(aes) -q 4edb58e8d5eb6bc711c43a6f3693daebde2e5524f1b55297abb29f003236e43d -t a7877c99 -n 674742abd0f5ba -k 2861fd0253705d7875c95ba8a53171b4 -a fb7bc304a3909e66e2e0c5ef952712dd884ce3e7324171369f2c5db1adc48c7d)
> > Exp 8dd351509dcf1df9[...]
> > Got EBADMSG
> 
> Sorry I got the maths wrong.  This one works for me:
> 
> ---8<---
> The check for the minimum receive buffer size did not take the
> tag size into account during decryption.  Fix this by adding the
> required extra length.
> 
> Reported-by: syzbot+aa11561819dc42ebbc7c@syzkaller.appspotmail.com
> Reported-by: Daniel Pouzzner <douzzer@mega.nu>
> Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management")
> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
> 
> diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
> index dda15bb05e89..f8bd45f7dc83 100644
> --- a/crypto/algif_aead.c
> +++ b/crypto/algif_aead.c
> @@ -144,7 +144,7 @@ static int _aead_recvmsg(struct socket *sock, struct msghdr *msg,
>  	if (usedpages < outlen) {
>  		size_t less = outlen - usedpages;
>  
> -		if (used < less) {
> +		if (used < less + (ctx->enc ? 0 : as)) {
>  			err = -EINVAL;
>  			goto free;
>  		}