* [PATCH] KEYS: Fix signature input size for KEYCTL_PKEY_VERIFY
@ 2026-11-13 14:03 Stefan Berger
2026-11-13 14:10 ` Jarkko Sakkinen
0 siblings, 1 reply; 5+ messages in thread
From: Stefan Berger @ 2026-11-13 14:03 UTC (permalink / raw)
To: jarkko, keyrings, linux-kernel; +Cc: dhowells, Stefan Berger, Florian Bauckholt
Revert the changes made for signature verification in cb481e59ea6c back
to the old behavior where effectively the params->in2_len was set to the
length of the user provided buffer uparams.in2_len (out_len is an alias
for in2_len due to the union). We cannot use the max_sig_size in the
case of signature verification since this is neither the true size of the
input buffer nor would it pass tests of size indicators found in the ASN.1
in the buffer comparing against the input buffer size.
Fixes: cb481e59ea6c ("KEYS: fix overflow in keyctl_pkey_params_get_2()")
Cc: Jarkko Sakkinen <jarkko@kernel.org>
Cc: Florian Bauckholt <florian.bauckholt@cispa.de>
Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
---
security/keys/keyctl_pkey.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c
index 15b6bf6399b5..794fa3d01911 100644
--- a/security/keys/keyctl_pkey.c
+++ b/security/keys/keyctl_pkey.c
@@ -160,7 +160,7 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par
uparams.in2_len > info.max_sig_size)
return -EINVAL;
- params->out_len = info.max_sig_size;
+ params->in2_len = uparams.in2_len;
break;
default:
return -EOPNOTSUPP;
--
2.56.0
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH] KEYS: Fix signature input size for KEYCTL_PKEY_VERIFY
2026-11-13 14:03 [PATCH] KEYS: Fix signature input size for KEYCTL_PKEY_VERIFY Stefan Berger
@ 2026-11-13 14:10 ` Jarkko Sakkinen
2026-11-13 14:11 ` Jarkko Sakkinen
0 siblings, 1 reply; 5+ messages in thread
From: Jarkko Sakkinen @ 2026-11-13 14:10 UTC (permalink / raw)
To: Stefan Berger; +Cc: keyrings, linux-kernel, dhowells, Florian Bauckholt
On Fri, Nov 13, 2026 at 09:03:11AM -0500, Stefan Berger wrote:
> Revert the changes made for signature verification in cb481e59ea6c back
> to the old behavior where effectively the params->in2_len was set to the
> length of the user provided buffer uparams.in2_len (out_len is an alias
> for in2_len due to the union). We cannot use the max_sig_size in the
> case of signature verification since this is neither the true size of the
> input buffer nor would it pass tests of size indicators found in the ASN.1
> in the buffer comparing against the input buffer size.
>
> Fixes: cb481e59ea6c ("KEYS: fix overflow in keyctl_pkey_params_get_2()")
> Cc: Jarkko Sakkinen <jarkko@kernel.org>
> Cc: Florian Bauckholt <florian.bauckholt@cispa.de>
> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> ---
> security/keys/keyctl_pkey.c | 2 +-
> 1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c
> index 15b6bf6399b5..794fa3d01911 100644
> --- a/security/keys/keyctl_pkey.c
> +++ b/security/keys/keyctl_pkey.c
> @@ -160,7 +160,7 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par
> uparams.in2_len > info.max_sig_size)
> return -EINVAL;
>
> - params->out_len = info.max_sig_size;
> + params->in2_len = uparams.in2_len;
> break;
> default:
> return -EOPNOTSUPP;
> --
> 2.56.0
>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Thanks.
Br, Jarkko
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] KEYS: Fix signature input size for KEYCTL_PKEY_VERIFY
2026-11-13 14:10 ` Jarkko Sakkinen
@ 2026-11-13 14:11 ` Jarkko Sakkinen
2026-11-13 14:45 ` Stefan Berger
0 siblings, 1 reply; 5+ messages in thread
From: Jarkko Sakkinen @ 2026-11-13 14:11 UTC (permalink / raw)
To: Stefan Berger; +Cc: keyrings, linux-kernel, dhowells, Florian Bauckholt
On Fri, Nov 13, 2026 at 04:10:12PM +0200, Jarkko Sakkinen wrote:
> On Fri, Nov 13, 2026 at 09:03:11AM -0500, Stefan Berger wrote:
> > Revert the changes made for signature verification in cb481e59ea6c back
> > to the old behavior where effectively the params->in2_len was set to the
> > length of the user provided buffer uparams.in2_len (out_len is an alias
> > for in2_len due to the union). We cannot use the max_sig_size in the
> > case of signature verification since this is neither the true size of the
> > input buffer nor would it pass tests of size indicators found in the ASN.1
> > in the buffer comparing against the input buffer size.
> >
> > Fixes: cb481e59ea6c ("KEYS: fix overflow in keyctl_pkey_params_get_2()")
> > Cc: Jarkko Sakkinen <jarkko@kernel.org>
> > Cc: Florian Bauckholt <florian.bauckholt@cispa.de>
> > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> > ---
> > security/keys/keyctl_pkey.c | 2 +-
> > 1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c
> > index 15b6bf6399b5..794fa3d01911 100644
> > --- a/security/keys/keyctl_pkey.c
> > +++ b/security/keys/keyctl_pkey.c
> > @@ -160,7 +160,7 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par
> > uparams.in2_len > info.max_sig_size)
> > return -EINVAL;
> >
> > - params->out_len = info.max_sig_size;
> > + params->in2_len = uparams.in2_len;
> > break;
> > default:
> > return -EOPNOTSUPP;
> > --
> > 2.56.0
> >
>
>
> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Did we have reported-by and closes tags for this?
Br, Jarkko
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] KEYS: Fix signature input size for KEYCTL_PKEY_VERIFY
2026-11-13 14:11 ` Jarkko Sakkinen
@ 2026-11-13 14:45 ` Stefan Berger
2026-11-13 14:47 ` Jarkko Sakkinen
0 siblings, 1 reply; 5+ messages in thread
From: Stefan Berger @ 2026-11-13 14:45 UTC (permalink / raw)
To: Jarkko Sakkinen; +Cc: keyrings, linux-kernel, dhowells, Florian Bauckholt
On 11/13/26 9:11 AM, Jarkko Sakkinen wrote:
> On Fri, Nov 13, 2026 at 04:10:12PM +0200, Jarkko Sakkinen wrote:
>> On Fri, Nov 13, 2026 at 09:03:11AM -0500, Stefan Berger wrote:
>>> Revert the changes made for signature verification in cb481e59ea6c back
>>> to the old behavior where effectively the params->in2_len was set to the
>>> length of the user provided buffer uparams.in2_len (out_len is an alias
>>> for in2_len due to the union). We cannot use the max_sig_size in the
>>> case of signature verification since this is neither the true size of the
>>> input buffer nor would it pass tests of size indicators found in the ASN.1
>>> in the buffer comparing against the input buffer size.
>>>
>>> Fixes: cb481e59ea6c ("KEYS: fix overflow in keyctl_pkey_params_get_2()")
>>> Cc: Jarkko Sakkinen <jarkko@kernel.org>
>>> Cc: Florian Bauckholt <florian.bauckholt@cispa.de>
>>> Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
>>> ---
>>> security/keys/keyctl_pkey.c | 2 +-
>>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>>
>>> diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c
>>> index 15b6bf6399b5..794fa3d01911 100644
>>> --- a/security/keys/keyctl_pkey.c
>>> +++ b/security/keys/keyctl_pkey.c
>>> @@ -160,7 +160,7 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par
>>> uparams.in2_len > info.max_sig_size)
>>> return -EINVAL;
>>>
>>> - params->out_len = info.max_sig_size;
>>> + params->in2_len = uparams.in2_len;
>>> break;
>>> default:
>>> return -EOPNOTSUPP;
>>> --
>>> 2.56.0
>>>
>>
>>
>> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
>
> Did we have reported-by and closes tags for this?
Let me add this here for v2:
Link:
https://lore.kernel.org/linux-crypto/473700a3-f5d7-4a7a-b89a-12c51adcc3df@cispa.de/T/#t
Reported-by: Sashiko <sashiko-bot@kernel.org>
Once Florian added his Tested-by: to v1 should I then add this?
Cc: stable@vger.kernel.org
>
> Br, Jarkko
^ permalink raw reply [flat|nested] 5+ messages in thread* Re: [PATCH] KEYS: Fix signature input size for KEYCTL_PKEY_VERIFY
2026-11-13 14:45 ` Stefan Berger
@ 2026-11-13 14:47 ` Jarkko Sakkinen
0 siblings, 0 replies; 5+ messages in thread
From: Jarkko Sakkinen @ 2026-11-13 14:47 UTC (permalink / raw)
To: Stefan Berger; +Cc: keyrings, linux-kernel, dhowells, Florian Bauckholt
On Fri, Nov 13, 2026 at 09:45:05AM -0500, Stefan Berger wrote:
>
>
> On 11/13/26 9:11 AM, Jarkko Sakkinen wrote:
> > On Fri, Nov 13, 2026 at 04:10:12PM +0200, Jarkko Sakkinen wrote:
> > > On Fri, Nov 13, 2026 at 09:03:11AM -0500, Stefan Berger wrote:
> > > > Revert the changes made for signature verification in cb481e59ea6c back
> > > > to the old behavior where effectively the params->in2_len was set to the
> > > > length of the user provided buffer uparams.in2_len (out_len is an alias
> > > > for in2_len due to the union). We cannot use the max_sig_size in the
> > > > case of signature verification since this is neither the true size of the
> > > > input buffer nor would it pass tests of size indicators found in the ASN.1
> > > > in the buffer comparing against the input buffer size.
> > > >
> > > > Fixes: cb481e59ea6c ("KEYS: fix overflow in keyctl_pkey_params_get_2()")
> > > > Cc: Jarkko Sakkinen <jarkko@kernel.org>
> > > > Cc: Florian Bauckholt <florian.bauckholt@cispa.de>
> > > > Signed-off-by: Stefan Berger <stefanb@linux.ibm.com>
> > > > ---
> > > > security/keys/keyctl_pkey.c | 2 +-
> > > > 1 file changed, 1 insertion(+), 1 deletion(-)
> > > >
> > > > diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c
> > > > index 15b6bf6399b5..794fa3d01911 100644
> > > > --- a/security/keys/keyctl_pkey.c
> > > > +++ b/security/keys/keyctl_pkey.c
> > > > @@ -160,7 +160,7 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par
> > > > uparams.in2_len > info.max_sig_size)
> > > > return -EINVAL;
> > > > - params->out_len = info.max_sig_size;
> > > > + params->in2_len = uparams.in2_len;
> > > > break;
> > > > default:
> > > > return -EOPNOTSUPP;
> > > > --
> > > > 2.56.0
> > > >
> > >
> > >
> > > Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
> >
> > Did we have reported-by and closes tags for this?
>
> Let me add this here for v2:
>
> Link: https://lore.kernel.org/linux-crypto/473700a3-f5d7-4a7a-b89a-12c51adcc3df@cispa.de/T/#t
> Reported-by: Sashiko <sashiko-bot@kernel.org>
>
> Once Florian added his Tested-by: to v1 should I then add this?
>
> Cc: stable@vger.kernel.org
Nah, I don't care about Sashiko tags, no need to add em.
Go ahead and add Florian's tested-by.
Br, Jarkko
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-11-13 14:47 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-11-13 14:03 [PATCH] KEYS: Fix signature input size for KEYCTL_PKEY_VERIFY Stefan Berger
2026-11-13 14:10 ` Jarkko Sakkinen
2026-11-13 14:11 ` Jarkko Sakkinen
2026-11-13 14:45 ` Stefan Berger
2026-11-13 14:47 ` Jarkko Sakkinen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox