Re: [PATCH v1 1/1] pkey: Fix bitsize check in PKEY_VERIFYPROTK ioctl

[Harald Freudenberger <freude@linux.ibm.com>]

On 2026-06-19 10:32, Ingo Franzki wrote:
> On 19.06.2026 09:45, Holger Dengler wrote:
>> As part of the verification, the PKEY_VERIFYPROTK ioctl checks for
>> supported keytype, which are derived from the bit-size of the key. The
>> calculation for the bit-size of a protected key has to take into
>> account, that the length of the protected key blob also includes the
>> length of the wrapping key verification pattern (WKVP). Subtract the
>> length of the MKVP from the protected key length fixes this
>> calculation.
>> 
>> Fixes: 8fcc231ce3be ("s390/pkey: Introduce pkey base with handler 
>> registry and handler modules")
>> Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
>> ---
>>  drivers/s390/crypto/pkey_api.c | 3 ++-
>>  1 file changed, 2 insertions(+), 1 deletion(-)
>> 
>> diff --git a/drivers/s390/crypto/pkey_api.c 
>> b/drivers/s390/crypto/pkey_api.c
>> index d6b595eb3370..2160e1de3014 100644
>> --- a/drivers/s390/crypto/pkey_api.c
>> +++ b/drivers/s390/crypto/pkey_api.c
>> @@ -334,7 +334,8 @@ static int pkey_ioctl_verifyprotk(struct 
>> pkey_verifyprotk __user *uvp)
>>  	if (copy_from_user(&kvp, uvp, sizeof(kvp)))
>>  		return -EFAULT;
>> 
>> -	keytype = pkey_aes_bitsize_to_keytype(8 * kvp.protkey.len);
>> +	keytype = pkey_aes_bitsize_to_keytype(8 * (kvp.protkey.len -
>> +						   AES_WK_VP_SIZE));
>>  	if (!keytype) {
>>  		PKEY_DBF_ERR("%s unknown/unsupported protkey length %u\n",
>>  			     __func__, kvp.protkey.len);
> 
> Why not simply use
> 
>      t->keytype = kvp.protkey.type;
> 
> and remove the whole 'keytype = pkey_aes_bitsize_to_keytype(....)' 
> thing ?
> The type of the protected key is already contained in the protected
> key structure, so why trying to guess it from the size again?

Not sure how this comes from. However, as this function anyway is only
valid to be called for protected AES keys I would stay with the guessing
from the length.

> 
> You will need a length check for the 'memcpy(t->protkey,
> kvp.protkey.protkey, kvp.protkey.len);' (regardless of how you
> determine the type).

As you wrote, the length still needs to be checked here for <= 
sizeof(t->protkey).