Re: [PATCH v10 5/5] s390/zcrypt: Pad trailing CCA or EP11 message with zeros
Holger Dengler <[email protected]>
| Newsgroups | org.kernel.vger.linux-s390 |
|---|---|
| Message-ID | <[email protected]> |
On 7/30/26 16:15, Harald Freudenberger wrote:
> The both functions xcrb_msg_to_type6cprb_msgx() and
> xcrb_msg_to_type6_ep11cprb_msgx() copy the user space message into a
> kernel buffer based on the message length. But on further processing
> the message is supposed to be 4 byte length adjusted. Thus up to 3
> bytes of uninitialized kernel memory are forwarded to further
> processing steps and may unwanted expose kernel memory to the crypto
> card firmware.
>
> This patch contains code to pad the gap between user space copied
> message and message buffer length sent down to further processing of
> the CCA or EP11 message to zeros.
>
> Fixes: e2c6d91eb8b1 ("s390/zcrypt: Rework domain processing within zcrypt device driver")
> Signed-off-by: Harald Freudenberger <[email protected]>
> Cc: [email protected] # 7.1+
Reviewed-by: Holger Dengler <[email protected]>
--
Mit freundlichen Grüßen / Kind regards
Holger Dengler