Re: [PATCH] crypto: virtio: validate akcipher completion length

[Herbert Xu <herbert@gondor.apana.org.au>]

On Fri, Aug 21, 2026 at 09:55:12AM +0000, Jérémy Jean wrote:
> The device controls the used length returned for an akcipher request.
> Subtracting the status byte without validating that length can underflow
> dst_len, while accepting a payload larger than the submitted destination
> can make sg_copy_from_buffer() read past the response buffer.
> 
> Reject malformed completion lengths before updating dst_len or copying the
> response.
> 
> Fixes: a36bd0ad9fbf ("virtio-crypto: adjust dst_len at ops callback")
> Assisted-by: Codex:gpt-5
> Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
> ---
>  drivers/crypto/virtio/virtio_crypto_akcipher_algs.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c b/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
> index d8d452cac391..886032abae80 100644
> --- a/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
> +++ b/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
> @@ -69,6 +69,7 @@ static void virtio_crypto_dataq_akcipher_callback(struct virtio_crypto_request *
>  	struct akcipher_request *akcipher_req =
>  		container_of((void *)vc_akcipher_req, struct akcipher_request,
>  			     __ctx);
> +	unsigned int dst_len;
>  	int error;
>  
>  	switch (vc_req->status) {
> @@ -88,9 +89,19 @@ static void virtio_crypto_dataq_akcipher_callback(struct virtio_crypto_request *
>  	}
>  
>  	/* actual length may be less than dst buffer */
> -	akcipher_req->dst_len = len - sizeof(vc_req->status);

This appears to have already been fixed by

commit f77a956f6a19f9463ef1527c9d0cda50dded6b92
Author: Bryam Vargas <hexlabsecurity@proton.me>
Date:   Mon Jun 22 01:52:15 2026 -0500

    crypto: virtio - bound the akcipher result length

Please check that commit and see if it's sufficient or not.

Thanks,
-- 
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt