[PATCH 6.1/6.6/6.12.y] crypto: rsa-pkcs1pad: Don't WARN on an empty digest

[PATCH 6.1/6.6/6.12.y] crypto: rsa-pkcs1pad: Don't WARN on an empty digest

[Doruk Tan Ozturk]

KEYCTL_PKEY_VERIFY lets an unprivileged caller supply a zero-length
digest (in_len == 0).  keyctl_pkey_params_get_2() accepts the zero
length and the request reaches pkcs1pad_verify(), where the empty
digest is rejected but only after being passed through
WARN_ON(!digest_size).  The warning is therefore directly
user-triggerable, and on kernels built with panic_on_warn=1 an
unprivileged process can panic the machine -- a local denial of
service.  Reproduced as UID 65534 in a setuid sandbox.

Keep rejecting the invalid request with -EINVAL, but do not emit a
warning for the user-controlled length.

Mainline does not contain this code path; commit 1e562deacecc
("crypto: rsassa-pkcs1 - Migrate to sig_alg backend") removed
pkcs1pad_verify() in v6.13-rc1.  This is a minimal fix for the
affected stable branches.  It applies as-is to 6.1.y, 6.6.y and
6.12.y (identical pkcs1pad_verify); the 5.10.y/5.15.y form is sent
as a separate patch due to the older req->dst_len spelling.

Found by 0sec automated security-research tooling (https://0sec.ai).

Fixes: c7381b012872 ("crypto: akcipher - new verify API for public key algorithms")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:multi-model
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
 crypto/rsa-pkcs1pad.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/crypto/rsa-pkcs1pad.c b/crypto/rsa-pkcs1pad.c
index cd501195f34a..225fcc3377dd 100644
--- a/crypto/rsa-pkcs1pad.c
+++ b/crypto/rsa-pkcs1pad.c
@@ -557,7 +557,7 @@ static int pkcs1pad_verify(struct akcipher_request *req)
 	const unsigned int digest_size = req->dst_len;
 	int err;
 
-	if (WARN_ON(req->dst) || WARN_ON(!digest_size) ||
+	if (WARN_ON(req->dst) || !digest_size ||
 	    !ctx->key_size || sig_size != ctx->key_size)
 		return -EINVAL;
 
-- 
2.43.0

Re: [PATCH 6.1/6.6/6.12.y] crypto: rsa-pkcs1pad: Don't WARN on an empty digest

[Sasha Levin]

> KEYCTL_PKEY_VERIFY lets an unprivileged caller supply a zero-length
> digest (in_len == 0).  keyctl_pkey_params_get_2() accepts the zero
> length and the request reaches pkcs1pad_verify(), where the empty
> digest is rejected but only after being passed through
> WARN_ON(!digest_size).
[...]
> Mainline does not contain this code path; commit 1e562deacecc
> ("crypto: rsassa-pkcs1 - Migrate to sig_alg backend") removed
> pkcs1pad_verify() in v6.13-rc1.  This is a minimal fix for the
> affected stable branches.

The fix looks correct to me and matches the mainline end state (the
sig_alg replacement rejects an empty digest with a plain -EINVAL and
no WARN). But since this is a stable-only patch with no upstream
commit to reference, I'd like a crypto maintainer ack before queueing
it.

-- 
Thanks,
Sasha

Re: [PATCH 6.1/6.6/6.12.y] crypto: rsa-pkcs1pad: Don't WARN on an empty digest

[Doruk (0sec)]

Hi Herbert,

Sasha reviewed this as matching mainline’s no-WARN/-EINVAL behavior
and asked for a crypto-maintainer Ack before queueing it. The patch
only removes WARN_ON() for the user-controlled empty digest; invalid
input remains rejected.

Would you be comfortable Acking the attached stable variants?

Thanks,
Doruk

Re: [PATCH 6.1/6.6/6.12.y] crypto: rsa-pkcs1pad: Don't WARN on an empty digest

[Herbert Xu]

On Sat, Jul 25, 2026 at 02:04:14PM -0500, Doruk (0sec) wrote:
> Hi Herbert,
> 
> Sasha reviewed this as matching mainline’s no-WARN/-EINVAL behavior
> and asked for a crypto-maintainer Ack before queueing it. The patch
> only removes WARN_ON() for the user-controlled empty digest; invalid
> input remains rejected.
> 
> Would you be comfortable Acking the attached stable variants?

Forwarding to Lukas/Ignat for comment.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt

Re: [PATCH 6.1/6.6/6.12.y] crypto: rsa-pkcs1pad: Don't WARN on an empty digest

[Lukas Wunner]

On Mon, Jul 20, 2026 at 09:15:25PM +0200, Doruk Tan Ozturk wrote:
> KEYCTL_PKEY_VERIFY lets an unprivileged caller supply a zero-length
> digest (in_len == 0).  keyctl_pkey_params_get_2() accepts the zero
> length and the request reaches pkcs1pad_verify(), where the empty
> digest is rejected but only after being passed through
> WARN_ON(!digest_size).  The warning is therefore directly
> user-triggerable, and on kernels built with panic_on_warn=1 an
> unprivileged process can panic the machine -- a local denial of
> service.  Reproduced as UID 65534 in a setuid sandbox.
> 
> Keep rejecting the invalid request with -EINVAL, but do not emit a
> warning for the user-controlled length.
> 
> Mainline does not contain this code path; commit 1e562deacecc
> ("crypto: rsassa-pkcs1 - Migrate to sig_alg backend") removed
> pkcs1pad_verify() in v6.13-rc1.  This is a minimal fix for the
> affected stable branches.  It applies as-is to 6.1.y, 6.6.y and
> 6.12.y (identical pkcs1pad_verify); the 5.10.y/5.15.y form is sent
> as a separate patch due to the older req->dst_len spelling.
> 
> Found by 0sec automated security-research tooling (https://0sec.ai).
> 
> Fixes: c7381b012872 ("crypto: akcipher - new verify API for public key algorithms")
> Cc: stable@vger.kernel.org
> Assisted-by: 0sec:multi-model
> Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>

Reviewed-by: Lukas Wunner <lukas@wunner.de>

Re: [PATCH 6.1/6.6/6.12.y] crypto: rsa-pkcs1pad: Don't WARN on an empty digest

[Sasha Levin]

On Mon, Jul 27, 2026 at 12:29:58PM +0200, Lukas Wunner wrote:
>Reviewed-by: Lukas Wunner <lukas@wunner.de>

Thanks Lukas!

Queued for 6.1, 6.6 and 6.12, thanks.

-- 
Thanks,
Sasha