From f173195e53078dd2a9688f916e12a0f3742ecd6a Mon Sep 17 00:00:00 2001 From: Giovanni Cabiddu Date: Fri, 7 Mar 2025 09:05:04 +0800 Subject: [PATCH] crypto: qat - add param check for DH mainline inclusion from mainline-v5.19-rc1 commit 2acbb8771f6ac82422886e63832ee7a0f4b1635b category: bugfix bugzilla: https://gitee.com/openeuler/kernel/issues/IBP212 CVE: CVE-2022-49564 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2acbb8771f6ac82422886e63832ee7a0f4b1635b -------------------------------- Reject requests with a source buffer that is bigger than the size of the key. This is to prevent a possible integer underflow that might happen when copying the source scatterlist into a linear buffer. Cc: stable@vger.kernel.org Signed-off-by: Giovanni Cabiddu Reviewed-by: Adam Guerin Reviewed-by: Wojciech Ziemba Signed-off-by: Herbert Xu Signed-off-by: Yifan Qiao --- drivers/crypto/qat/qat_common/qat_asym_algs.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/drivers/crypto/qat/qat_common/qat_asym_algs.c b/drivers/crypto/qat/qat_common/qat_asym_algs.c index 320e7854b4ee..7eab5078fecd 100644 --- a/drivers/crypto/qat/qat_common/qat_asym_algs.c +++ b/drivers/crypto/qat/qat_common/qat_asym_algs.c @@ -273,6 +273,10 @@ static int qat_dh_compute_value(struct kpp_request *req) req->dst_len = ctx->p_size; return -EOVERFLOW; } + + if (req->src_len > ctx->p_size) + return -EINVAL; + memset(msg, '\0', sizeof(*msg)); ICP_QAT_FW_PKE_HDR_VALID_FLAG_SET(msg->pke_hdr, ICP_QAT_FW_COMN_REQ_FLAG_SET); -- Gitee