Re: [PATCH v7 0/1] Improve zcrypt reply message verification checks

[Vasily Gorbik <gor@linux.ibm.com>]

On Fri, Aug 07, 2026 at 12:19:17PM +0200, Harald Freudenberger wrote:
> Add or improve checks related to buffer sizes and reply sizes to the
> handling of replies from the crypto cards for CCA, EP11 (AP message
> type 6) and ICA (AP type 50) messages. The verification code related
> to reply field length was not designed well and thus firmware
> deficiencies could lead to unexpected behavior in the zcrypt device
> driver. Thus improve the code to more closely inspect especially
> length fields at message replies.
> 
> Rework zcrypt_msgtype6_receive(), zcrypt_msgtype6_receive_ep11() and
> zcrypt_msgtype50_receive() to validate reply lengths more carefully
> before copying data back into the request buffer. Use size_t for
> length calculations, reject inconsistent reply sizes, and add
> defensive handling for short invalid replies. For XCRB replies,
> validate both reply segments and derive the effective message length
> from the covered range instead of trusting only the second segment.
> 
> Changelog:
> v1 - initial patch
> v2 - fixed typo in header check_for_overflow -> check_add_overflow.
> v3 - rephrased and smoothed subject and text of the patch. It is now
>      "s390/zcrypt: Improve zcrypt reply message verification checks"
>      and the text does not talk about malicious cards any more.
>      Updated Reviewed-by tags
> v4 - As sashiko clearly states the addition of two 32 bit values can
>      mathematically never overflow a 64 bit value and thus the
>      check_add_overflow() was total overkill - removed.
> v5 - Sashiko had a by-catch related to the very same fields. Under
>      some circumstances the fields count1 and offset1 of the CPRB
>      where not checked but used for a memcpy to userspace. So again a
>      rework of the check of these x86 header fields in the receiving
>      function before the CPRB is processed to be copied in parts to
>      userspace. Removed all reviewed-by as I want to have another
>      developer look onto this patch again.
> v6 - Again reworked and re-structured the code. As the very same
>      pattern appears with message type 50 also reworked the receive
>      function there.
> v7 - Reworked the debug messages based on feedback from Finn. These
>      messages should be real debug messages (so use pr_debug) as the
>      intended consumer is a developer. Thus the somehow cryptic debug
>      message text. Picked Finn's suggestion to avoid hard coded ERRNO
>      message strings and use %d with the real rc instead.
> 
> Harald Freudenberger (1):
>   s390/zcrypt: Improve zcrypt reply message verification checks
> 
>  drivers/s390/crypto/zcrypt_msgtype50.c |  39 ++++---
>  drivers/s390/crypto/zcrypt_msgtype6.c  | 149 ++++++++++++++++---------
>  2 files changed, 124 insertions(+), 64 deletions(-)

Applied, thank you!