Linux kernel -stable discussions
 help / color / mirror / Atom feed
* FAILED: patch "[PATCH] crypto: virtio - bound the akcipher result length" failed to apply to 6.12-stable tree
@ 2026-08-31 13:00 gregkh
  2026-09-01 12:10 ` [PATCH 6.12.y 1/4] crypto: virtio - Drop sign/verify operations Sasha Levin
  0 siblings, 1 reply; 5+ messages in thread
From: gregkh @ 2026-08-31 13:00 UTC (permalink / raw)
  To: hexlabsecurity, mst; +Cc: stable


The patch below does not apply to the 6.12-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@vger.kernel.org>.

To reproduce the conflict and resubmit, you may use the following commands:

git fetch https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ linux-6.12.y
git checkout FETCH_HEAD
git cherry-pick -x f77a956f6a19f9463ef1527c9d0cda50dded6b92
# <resolve conflicts, build, test, etc.>
git commit -s
git send-email --to '<stable@vger.kernel.org>' --in-reply-to '2026083110-catcall-outtakes-9ceb@gregkh' --subject-prefix 'PATCH 6.12.y' 'HEAD^..'

Possible dependencies:



thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From f77a956f6a19f9463ef1527c9d0cda50dded6b92 Mon Sep 17 00:00:00 2001
From: Bryam Vargas <hexlabsecurity@proton.me>
Date: Mon, 22 Jun 2026 01:52:15 -0500
Subject: [PATCH] crypto: virtio - bound the akcipher result length

virtio_crypto_dataq_akcipher_callback() sets the result length from the
device-reported response length without bounding it to the destination
buffer, which was allocated for the original request length.
sg_copy_from_buffer() then reads that many bytes from the destination
buffer; a backend reporting a larger length over-reads adjacent kernel
heap into the caller's scatterlist (an out-of-bounds read).

Clamp the reported length to the originally requested destination length.
A conforming device reports no more than that, so valid results are
unaffected.

Fixes: a36bd0ad9fbf ("virtio-crypto: adjust dst_len at ops callback")
Cc: stable@vger.kernel.org
Signed-off-by: Bryam Vargas <hexlabsecurity@proton.me>
Message-ID: <20260622-b4-disp-3a2c09a8-v2-1-d1a809281db4@proton.me>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>

diff --git a/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c b/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
index d8d452cac391..64ea141f018c 100644
--- a/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
+++ b/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
@@ -88,7 +88,8 @@ static void virtio_crypto_dataq_akcipher_callback(struct virtio_crypto_request *
 	}
 
 	/* actual length may be less than dst buffer */
-	akcipher_req->dst_len = len - sizeof(vc_req->status);
+	akcipher_req->dst_len = min_t(unsigned int, len - sizeof(vc_req->status),
+				      akcipher_req->dst_len);
 	sg_copy_from_buffer(akcipher_req->dst, sg_nents(akcipher_req->dst),
 			    vc_akcipher_req->dst_buf, akcipher_req->dst_len);
 	virtio_crypto_akcipher_finalize_req(vc_akcipher_req, akcipher_req, error);


^ permalink raw reply related	[flat|nested] 5+ messages in thread
end of thread, other threads:[~2026-09-01 12:10 UTC | newest]

Thread overview: 5+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-31 13:00 FAILED: patch "[PATCH] crypto: virtio - bound the akcipher result length" failed to apply to 6.12-stable tree gregkh
2026-09-01 12:10 ` [PATCH 6.12.y 1/4] crypto: virtio - Drop sign/verify operations Sasha Levin
2026-09-01 12:10   ` [PATCH 6.12.y 2/4] crypto: virtio - Drop superfluous [as]kcipher_ctx pointer Sasha Levin
2026-09-01 12:10   ` [PATCH 6.12.y 3/4] crypto: virtio - Drop superfluous [as]kcipher_req pointer Sasha Levin
2026-09-01 12:10   ` [PATCH 6.12.y 4/4] crypto: virtio - bound the akcipher result length Sasha Levin

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox