Re: [PATCH v1 2/2] s390/zcrypt: Validate length for CCA ECC private key requests

[Harald Freudenberger <freude@linux.ibm.com>]

On 2026-07-29 11:36, Holger Dengler wrote:
> cca_ecc2protkey() derives the copy length for the CPRB parameter
> block directly from the length field in the key token. Reject the
> request early if the token length exceeds the available space in the
> parameter block.
> 
> Fixes: fa6999e326fe ("s390/pkey: support CCA and EP11 secure ECC 
> private keys")
> Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
> Cc: stable@vger.kernel.org # 5.10+
> ---
>  drivers/s390/crypto/zcrypt_ccamisc.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c
> b/drivers/s390/crypto/zcrypt_ccamisc.c
> index db6a4211a97e..322677a8d320 100644
> --- a/drivers/s390/crypto/zcrypt_ccamisc.c
> +++ b/drivers/s390/crypto/zcrypt_ccamisc.c
> @@ -1428,6 +1428,9 @@ int cca_ecc2protkey(u16 cardnr, u16 domain, const 
> u8 *key,
>  	} __packed * prepparm;
>  	int keylen = ((struct eccprivkeytoken *)key)->len;
> 
> +	if (keylen > PARMBSIZE - sizeof(struct aureqparm))
> +		return -EINVAL;
> +
>  	/* get already prepared memory for 2 cprbs with param block each */
>  	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
>  				    &preqcblk, &prepcblk, xflags);

Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>