[PATCH v1 1/1] s390/crypto: Fix out-of-bounds access in zcrypt message type handlers

[Harald Freudenberger <freude@linux.ibm.com>]

Add length validation before accessing reply message structures in
zcrypt_msgtype6_receive(), zcrypt_msgtype6_receive_ep11(), and
zcrypt_msgtype50_receive() to prevent out-of-bounds reads and
potential kernel memory disclosure.

The handlers now verify that reply->len is sufficient before accessing
structure fields like cprb_ver_id. When validation fails, only the
message type field is overwritten with an error code, preventing
attackers from mixing user-controlled request data with short hardware
responses to bypass validation and leak kernel memory.

Fixes: 3b6245fd303f ("s390/zcrypt: Separate msgtype implementation from card modules.")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Cc: stable@vger.kernel.org
---
 drivers/s390/crypto/zcrypt_msgtype50.c | 3 ++-
 drivers/s390/crypto/zcrypt_msgtype6.c  | 6 ++++--
 2 files changed, 6 insertions(+), 3 deletions(-)

diff --git a/drivers/s390/crypto/zcrypt_msgtype50.c b/drivers/s390/crypto/zcrypt_msgtype50.c
index 3c5fc97f7399..1f2b08ce3200 100644
--- a/drivers/s390/crypto/zcrypt_msgtype50.c
+++ b/drivers/s390/crypto/zcrypt_msgtype50.c
@@ -424,7 +424,8 @@ static void zcrypt_msgtype50_receive(struct ap_queue *aq,
 
 	t80h = reply->msg;
 
-	if (t80h->type != TYPE80_RSP_CODE) {
+	if (reply->len < sizeof(struct type80_hdr) ||
+	    t80h->type != TYPE80_RSP_CODE) {
 		if (reply->len < sizeof(error_reply))
 			memcpy(msg->msg, &error_reply, sizeof(error_reply));
 		else
diff --git a/drivers/s390/crypto/zcrypt_msgtype6.c b/drivers/s390/crypto/zcrypt_msgtype6.c
index 5af3e20ad114..100e5ef3cbd8 100644
--- a/drivers/s390/crypto/zcrypt_msgtype6.c
+++ b/drivers/s390/crypto/zcrypt_msgtype6.c
@@ -943,7 +943,8 @@ static void zcrypt_msgtype6_receive(struct ap_queue *aq,
 
 	t86r = reply->msg;
 
-	if (t86r->hdr.type != TYPE86_RSP_CODE ||
+	if (reply->len < sizeof(struct type86x_reply) ||
+	    t86r->hdr.type != TYPE86_RSP_CODE ||
 	    t86r->cprbx.cprb_ver_id != 0x02) {
 		if (reply->len < sizeof(error_reply))
 			memcpy(msg->msg, &error_reply, sizeof(error_reply));
@@ -1032,7 +1033,8 @@ static void zcrypt_msgtype6_receive_ep11(struct ap_queue *aq,
 
 	t86r = reply->msg;
 
-	if (t86r->hdr.type != TYPE86_RSP_CODE ||
+	if (reply->len < sizeof(struct type86_ep11_reply) ||
+	    t86r->hdr.type != TYPE86_RSP_CODE ||
 	    t86r->cprbx.cprb_ver_id != 0x04) {
 		if (reply->len < sizeof(error_reply))
 			memcpy(msg->msg, &error_reply, sizeof(error_reply));
-- 
2.43.0