github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-13 05:27:32 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

s390/zcrypt: Validate length in reply before using it

Browse Source 
The length information in the reply is used to copy the key token to
the target buffer. An invalid information in t->len of the reply may
cause an over-read of the target buffer and also a over-write of the
target buffer. To prevent that, check t->len before using it.

As the available space in destination and source buffer is always
larger than the valid length value in the parameter block in the
reply, compare t->len with this (already validated) length
information. As a side effect, this check also prevents buffer
over-read and over-write.

Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>
Signed-off-by: Heiko Carstens <hca@linux.ibm.com>
This commit is contained in:
Holger Dengler 2026-08-20 17:50:03 +02:00 committed by Heiko Carstens
parent 8ac60ae2a3
commit a91a5c25a2
1 changed files with 14 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
drivers/s390/crypto/zcrypt_ccamisc.c
View File

@ -1158,8 +1158,21 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
/* do not check the key here, it may be incomplete */
/* copy the vlsc key token back */
/*
* Copy the vlsc key token back.
* The available space in the destination (key_token) and the source
* (t) buffer is always larger as the valid range of prepparm->kb.len.
* Validate t->len by comparing it with the length information in the
* param block of the request (prepparm->kb.len)
* The value range of prepparm->kb.len has been checked above.
*/
t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token;
if (t->len != prepparm->kb.len - 3 * sizeof(uint16_t)) {
ZCRYPT_DBF_ERR("%s reply with invalid key_token length %u\n",
__func__, t->len);
rc = -EIO;
goto out;
}
memcpy(key_token, t, t->len);
*key_token_size = t->len;