Re: [PATCH v5 1/1] s390/zcrypt: Fix and improve zcrypt reply message verification checks

[Holger Dengler <dengler@linux.ibm.com>]

On 10/2/26 12:52, Harald Freudenberger wrote:
> Add or improve checks related to buffer sizes and reply sizes to the
> handling of replies from the crypto cards for CCA, EP11 (AP message
> type 6) and ICA (AP type 50) messages. The verification code related
> to reply field length was not designed well and thus firmware
> deficiencies could lead to unexpected behavior in the zcrypt device
> driver. Thus improve the code to more closely inspect especially
> length fields at message replies.
> 
> Add length validation before accessing reply message structures in
> zcrypt_msgtype6_receive(), zcrypt_msgtype6_receive_ep11(), and
> zcrypt_msgtype50_receive() to prevent out-of-bounds reads and
> potential kernel memory disclosure.
> 
> Also rework these three functions to validate reply lengths more
> carefully before copying data back into the request buffer. Use size_t
> for length calculations, reject inconsistent reply sizes, and add
> defensive handling for short invalid replies. For XCRB replies,
> validate both reply segments and derive the effective message length
> from the covered range instead of trusting only the second segment.
> 
> Additional improve some of the later invoked evaluation functions
> which further check the payload. Add comments about length assumptions
> and for the type50 processing rework the payload processing completely
> with removing a misplaced BUG_ON().
> 
> Fixes: 3b6245fd303f ("s390/zcrypt: Separate msgtype implementation from card modules.")
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
> Cc: stable@vger.kernel.org

Reviewed-by: Holger Dengler <dengler@linux.ibm.com>

-- 
Mit freundlichen Grüßen / Kind regards
Holger Dengler