Re: [PATCH v1 1/1] s390/crypto: Fix out-of-bounds access in zcrypt message type handlers

[Finn Callies <fcallies@linux.ibm.com>]

On 26.08.26 16:12, Harald Freudenberger wrote:
> Add length validation before accessing reply message structures in
> zcrypt_msgtype6_receive(), zcrypt_msgtype6_receive_ep11(), and
> zcrypt_msgtype50_receive() to prevent out-of-bounds reads and
> potential kernel memory disclosure.
> 
> The handlers now verify that reply->len is sufficient before accessing
> structure fields like cprb_ver_id. When validation fails, only the
> message type field is overwritten with an error code, preventing
> attackers from mixing user-controlled request data with short hardware
> responses to bypass validation and leak kernel memory.
> 
> Fixes: 3b6245fd303f ("s390/zcrypt: Separate msgtype implementation from card modules.")
> Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
> Cc: stable@vger.kernel.org
> ---
>   drivers/s390/crypto/zcrypt_msgtype50.c | 3 ++-
>   drivers/s390/crypto/zcrypt_msgtype6.c  | 6 ++++--
>   2 files changed, 6 insertions(+), 3 deletions(-)

[ snip ]

Reviewed-by: Finn Callies <fcallies@linux.ibm.com>