Re: [PATCH] crypto: virtio: validate akcipher completion length

["Jérémy Jean" <jeremy.jean@oss.cyber.gouv.fr>]

On 2026-09-08 11:20, Herbert Xu wrote:
> On Fri, Aug 21, 2026 at 09:55:12AM +0000, Jérémy Jean wrote:
>> The device controls the used length returned for an akcipher request.
>> Subtracting the status byte without validating that length can 
>> underflow
>> dst_len, while accepting a payload larger than the submitted 
>> destination
>> can make sg_copy_from_buffer() read past the response buffer.
>> 
>> Reject malformed completion lengths before updating dst_len or copying 
>> the
>> response.
>> 
>> Fixes: a36bd0ad9fbf ("virtio-crypto: adjust dst_len at ops callback")
>> Assisted-by: Codex:gpt-5
>> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
>> ---
>>  drivers/crypto/virtio/virtio_crypto_akcipher_algs.c | 13 
>> ++++++++++++-
>>  1 file changed, 12 insertions(+), 1 deletion(-)
>> 
>> diff --git a/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c 
>> b/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
>> index d8d452cac391..886032abae80 100644
>> --- a/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
>> +++ b/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
>> @@ -69,6 +69,7 @@ static void 
>> virtio_crypto_dataq_akcipher_callback(struct virtio_crypto_request *
>>  	struct akcipher_request *akcipher_req =
>>  		container_of((void *)vc_akcipher_req, struct akcipher_request,
>>  			     __ctx);
>> +	unsigned int dst_len;
>>  	int error;
>> 
>>  	switch (vc_req->status) {
>> @@ -88,9 +89,19 @@ static void 
>> virtio_crypto_dataq_akcipher_callback(struct virtio_crypto_request *
>>  	}
>> 
>>  	/* actual length may be less than dst buffer */
>> -	akcipher_req->dst_len = len - sizeof(vc_req->status);
> 
> This appears to have already been fixed by
> 
> commit f77a956f6a19f9463ef1527c9d0cda50dded6b92
> Author: Bryam Vargas <hexlabsecurity@proton.me>
> Date:   Mon Jun 22 01:52:15 2026 -0500
> 
>     crypto: virtio - bound the akcipher result length
> 
> Please check that commit and see if it's sufficient or not.
> 
> Thanks,

Hello,

Indeed, this fixes the bug.
Thanks for the pointer, I missed that patch.

Regards,
Jérémy