[PATCH v1 0/1] Fix zcrypt handler functions

[PATCH v1 0/1] Fix zcrypt handler functions

[Harald Freudenberger]

As of now only one patch dealing with a missing initial message length
check on receive of a zcrypt message type 50 or 6.

Changelog:
v0: Initial version, just one patch fixing missing initial message
    length check at all 3 handler functions.

Harald Freudenberger (1):
  s390/crypto: Fix out-of-bounds access in zcrypt message type handlers

 drivers/s390/crypto/zcrypt_msgtype50.c | 3 ++-
 drivers/s390/crypto/zcrypt_msgtype6.c  | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

--
2.43.0

[PATCH v1 1/1] s390/crypto: Fix out-of-bounds access in zcrypt message type handlers

[Harald Freudenberger]

Add length validation before accessing reply message structures in
zcrypt_msgtype6_receive(), zcrypt_msgtype6_receive_ep11(), and
zcrypt_msgtype50_receive() to prevent out-of-bounds reads and
potential kernel memory disclosure.

The handlers now verify that reply->len is sufficient before accessing
structure fields like cprb_ver_id. When validation fails, only the
message type field is overwritten with an error code, preventing
attackers from mixing user-controlled request data with short hardware
responses to bypass validation and leak kernel memory.

Fixes: 3b6245fd303f ("s390/zcrypt: Separate msgtype implementation from card modules.")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Cc: stable@vger.kernel.org
---
 drivers/s390/crypto/zcrypt_msgtype50.c | 3 ++-
 drivers/s390/crypto/zcrypt_msgtype6.c  | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/s390/crypto/zcrypt_msgtype50.c b/drivers/s390/crypto/zcrypt_msgtype50.c
index 3c5fc97f7399..1f2b08ce3200 100644
--- a/drivers/s390/crypto/zcrypt_msgtype50.c
+++ b/drivers/s390/crypto/zcrypt_msgtype50.c
@@ -424,7 +424,8 @@ static void zcrypt_msgtype50_receive(struct ap_queue *aq,
 
 	t80h = reply->msg;
 
-	if (t80h->type != TYPE80_RSP_CODE) {
+	if (reply->len < sizeof(struct type80_hdr) ||
+	    t80h->type != TYPE80_RSP_CODE) {
 		if (reply->len < sizeof(error_reply))
 			memcpy(msg->msg, &error_reply, sizeof(error_reply));
 		else
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index 5af3e20ad114..100e5ef3cbd8 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -943,7 +943,8 @@ static void zcrypt_msgtype6_receive(struct ap_queue *aq,
 
 	t86r = reply->msg;
 
-	if (t86r->hdr.type != TYPE86_RSP_CODE ||
+	if (reply->len < sizeof(struct type86x_reply) ||
+	    t86r->hdr.type != TYPE86_RSP_CODE ||
 	    t86r->cprbx.cprb_ver_id != 0x02) {
 		if (reply->len < sizeof(error_reply))
 			memcpy(msg->msg, &error_reply, sizeof(error_reply));
@@ -1032,7 +1033,8 @@ static void zcrypt_msgtype6_receive_ep11(struct ap_queue *aq,
 
 	t86r = reply->msg;
 
-	if (t86r->hdr.type != TYPE86_RSP_CODE ||
+	if (reply->len < sizeof(struct type86_ep11_reply) ||
+	    t86r->hdr.type != TYPE86_RSP_CODE ||
 	    t86r->cprbx.cprb_ver_id != 0x04) {
 		if (reply->len < sizeof(error_reply))
 			memcpy(msg->msg, &error_reply, sizeof(error_reply));
-- 
2.43.0

Re: [PATCH v1 1/1] s390/crypto: Fix out-of-bounds access in zcrypt message type handlers

[Finn Callies]

On 26.08.26 16:12, Harald Freudenberger wrote:
> Add length validation before accessing reply message structures in
> zcrypt_msgtype6_receive(), zcrypt_msgtype6_receive_ep11(), and
> zcrypt_msgtype50_receive() to prevent out-of-bounds reads and
> potential kernel memory disclosure.
> 
> The handlers now verify that reply->len is sufficient before accessing
> structure fields like cprb_ver_id. When validation fails, only the
> message type field is overwritten with an error code, preventing
> attackers from mixing user-controlled request data with short hardware
> responses to bypass validation and leak kernel memory.
> 
> Fixes: 3b6245fd303f ("s390/zcrypt: Separate msgtype implementation from card modules.")
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
> Cc: stable@vger.kernel.org
> ---
>   drivers/s390/crypto/zcrypt_msgtype50.c | 3 ++-
>   drivers/s390/crypto/zcrypt_msgtype6.c  | 6 ++++--
>   2 files changed, 6 insertions(+), 3 deletions(-)

[ snip ]

Reviewed-by: Finn Callies <fcallies@linux.ibm.com>