Re: [PATCH v1 1/1] s390/zcrypt: Validate length in reply before using it

On 8/20/26 16:46, Harald Freudenberger wrote:
> On 2026-08-20 16:04, Holger Dengler wrote:
>> diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c
>> b/drivers/s390/crypto/zcrypt_ccamisc.c
>> index d4ce6352b5b2..54b8edd1dfc7 100644
>> --- a/drivers/s390/crypto/zcrypt_ccamisc.c
>> +++ b/drivers/s390/crypto/zcrypt_ccamisc.c
>> @@ -1158,8 +1158,21 @@ static int _ip_cprb_helper(u16 cardnr, u16 domain,
>>
>>      /* do not check the key here, it may be incomplete */
>>
>> -    /* copy the vlsc key token back */
>> +    /*
>> +     * Copy the vlsc key token back.
>> +     * The available space in the destination (key_token) and the source
>> +     * (t) buffer is always larger as the valid range of prepparm-
>> >kb.len.
>> +     * Validate t->len ba comparing it with the length information in
>> the
> 
> what is this funny "ba" in the previous sentence ?

A typo. Should be "by". Will be fixed in v2.

> 
>> +     * param block of the request (prepparm->kb.len)
>> +     * The value range of prepparm->kb.len has been checked above.
>> +     */
>>      t = (struct cipherkeytoken *)prepparm->kb.tlv1.key_token;
>> +    if (t->len != prepparm->kb.len - 3 * sizeof(uint16_t)) {
>> +        ZCRYPT_DBF_ERR("%s reply with invalid key_token length %u\n",
>> +                   __func__, t->len);
>> +        rc = -EIO;
>> +        goto out;
>> +    }
>>      memcpy(key_token, t, t->len);
>>      *key_token_size = t->len;
> 
> Reviewed-by: Harald Freudenberger <[email protected]>

Thx, I'll pick it for the v2.

-- 
Mit freundlichen Grüßen / Kind regards
Holger Dengler