Re: [PATCH v1 1/2] s390/zcrypt: Validate length for CCA AES cipher key requests

[Harald Freudenberger <freude@linux.ibm.com>]

On 2026-07-29 11:36, Holger Dengler wrote:
> cca_cipher2protkey() derives the copy length for the CPRB parameter
> block directly from the length field in the key token. Reject the
> request early if the token length exceeds the available space in the
> parameter block.
> 
> Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES
> cipher keys")
> Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
> Cc: stable@vger.kernel.org # 5.4+
> ---
>  drivers/s390/crypto/zcrypt_ccamisc.c | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c
> b/drivers/s390/crypto/zcrypt_ccamisc.c
> index 84936a795b95..db6a4211a97e 100644
> --- a/drivers/s390/crypto/zcrypt_ccamisc.c
> +++ b/drivers/s390/crypto/zcrypt_ccamisc.c
> @@ -1261,6 +1261,9 @@ int cca_cipher2protkey(u16 cardnr, u16 domain,
> const u8 *ckey,
>  	} __packed * prepparm;
>  	int keytoklen = ((struct cipherkeytoken *)ckey)->len;
> 
> +	if (keytoklen > PARMBSIZE - sizeof(struct aureqparm))
> +		return -EINVAL;
> +
>  	/* get already prepared memory for 2 cprbs with param block each */
>  	rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
>  				    &preqcblk, &prepcblk, xflags);

Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>