Re: [PATCH v1 1/1] s390/zcrypt: Validate length in reply before using it

On 2026-08-20 16:04, Holger Dengler wrote:
> The length information in the reply is used to copy the key token to
> the target buffer. An invalid information in t->len of the reply may
> cause an over-read of the target buffer and also a over-write of the
> target buffer. To prevent that, check t->len before using it.
> 
> As the available space in destination and source buffer is always
> larger than the valid length value in the parameter block in the
> reply, compare t->len with this (already validated) length
> information. As a side effect, this check also prevents buffer
> over-read and over-write.
> 
> Signed-off-by: Holger Dengler <[email protected]>
> ---
>  drivers/s390/crypto/zcrypt_ccamisc.c | 15 ++++++++++++++-
>  1 file changed, 14 insertions(+), 1 deletion(-)
> 
> diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c
> b/drivers/s390/crypto/zcrypt_ccamisc.c
> index d4ce6352b5b2..54b8edd1dfc7 100644
> --- a/drivers/s390/crypto/zcrypt_ccamisc.c
> +++ b/drivers/s390/crypto/zcrypt_ccamisc.c
> @@ -1158,8 +1158,21 @@ static int _ip_cprb_helper(u16 cardnr, u16 
> domain,
> 
>  	/* do not check the key here, it may be incomplete */
> 
> -	/* copy the vlsc key token back */
> +	/*
> +	 * Copy the vlsc key token back.
> +	 * The available space in the destination (key_token) and the source
> +	 * (t) buffer is always larger as the valid range of 
> prepparm->kb.len.
> +	 * Validate t->len ba comparing it with the length information in the

what is this funny "ba" in the previous sentence ?

> +	 * param block of the request (prepparm->kb.len)
> +	 * The value range of prepparm->kb.len has been checked above.
> +	 */
>  	t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token;
> +	if (t->len != prepparm->kb.len - 3 * sizeof(uint16_t)) {
> +		ZCRYPT_DBF_ERR("%s reply with invalid key_token length %u\n",
> +			       __func__, t->len);
> +		rc = -EIO;
> +		goto out;
> +	}
>  	memcpy(key_token, t, t->len);
>  	*key_token_size = t->len;

Reviewed-by: Harald Freudenberger <[email protected]>