From b5c2df42977390a71f1940def5be9bd5c69ac2e0 Mon Sep 17 00:00:00 2001 From: Aldo Ariel Panzardo Date: Fri, 25 Sep 2026 14:58:39 -0300 Subject: [PATCH] crypto: nx - validate 'ignore' before subtracting in decompress The decompress() function subtracts the header-supplied `ignore` value (a u16 from the compressed stream) from `dlen` (the number of bytes produced by the decompressor) without checking that ignore <= dlen. If a caller decompresses a crafted buffer where `hdr->ignore` exceeds the actual decompressed length, the subtraction wraps around to a near-UINT_MAX value. The subsequent memcpy() then copies gigabytes of data past the destination buffer, causing an out-of-bounds kernel write. Add a bounds check before the subtraction and return -EINVAL if the value is inconsistent. Cc: stable@vger.kernel.org Signed-off-by: Aldo Ariel Panzardo Signed-off-by: Herbert Xu --- drivers/crypto/nx/nx-842.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/drivers/crypto/nx/nx-842.c b/drivers/crypto/nx/nx-842.c index a61208cbcd27..b4404a138962 100644 --- a/drivers/crypto/nx/nx-842.c +++ b/drivers/crypto/nx/nx-842.c @@ -421,6 +421,8 @@ static int decompress(struct nx842_crypto_ctx *ctx, slen -= spadding; + if (ignore > dlen) + return -EINVAL; dlen -= ignore; if (ignore) pr_debug("ignoring last %x bytes\n", ignore);