Giovanni Cabiddu b3ac787565 crypto: qat - validate RSA CRT component lengths ... The generic RSA key parser (rsa_helper.c) bounds each CRT component (p, q, dp, dq, qinv) by the modulus size n_sz, but qat_rsa_setkey_crt() allocates half-size DMA buffers (key_sz / 2) and right-aligns each component with: memcpy(dst + half_key_sz - len, src, len) When a CRT component is larger than half_key_sz the subtraction underflows and memcpy writes past the DMA buffer, causing memory corruption. Add a len > half_key_sz check next to the existing !len check for each of the five CRT components so the driver falls back to the non-CRT path instead of writing out of bounds. Fixes: 879f77e907 ("crypto: qat - Add RSA CRT mode") Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu <giovanni.cabiddu@intel.com> Reviewed-by: Ahsan Atta <ahsan.atta@intel.com> Reviewed-by: Laurent M Coquerel <laurent.m.coquerel@intel.com> Tested-by: Laurent M Coquerel <laurent.m.coquerel@intel.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>		2026-06-11 13:53:58 +08:00
..
iaa	crypto: iaa - fix per-node CPU counter reset in rebalance_wq_table()	2026-04-03 08:56:11 +08:00
ixp4xx	crypto: ixp4xx - fix buffer chain unwind on allocation failure	2026-05-07 16:10:02 +08:00
keembay	crypto: intel/keembay-ocs-ecc - Use crypto_stdrng_get_bytes()	2026-04-03 08:56:12 +08:00
qat	crypto: qat - validate RSA CRT component lengths	2026-06-11 13:53:58 +08:00
Kconfig	crypto: iaa - Add Intel IAA Compression Accelerator crypto driver core	2023-12-15 17:52:53 +08:00
Makefile	crypto: iaa - Add Intel IAA Compression Accelerator crypto driver core	2023-12-15 17:52:53 +08:00