Re: [PATCH 5.10/5.15.y] crypto: rsa-pkcs1pad: Don't WARN on an empty digest

[Lukas Wunner]

On Mon, Jul 20, 2026 at 09:15:33PM +0200, Doruk Tan Ozturk wrote:
> KEYCTL_PKEY_VERIFY lets an unprivileged caller supply a zero-length
> digest (in_len == 0).  keyctl_pkey_params_get_2() accepts the zero
> length and the request reaches pkcs1pad_verify(), where the empty
> digest is rejected but only after being passed through
> WARN_ON(!req->dst_len).  The warning is therefore directly
> user-triggerable, and on kernels built with panic_on_warn=1 an
> unprivileged process can panic the machine -- a local denial of
> service.  Reproduced as UID 65534 in a setuid sandbox.
> 
> Keep rejecting the invalid request with -EINVAL, but do not emit a
> warning for the user-controlled length.
> 
> This is the 5.10.y/5.15.y form of the fix, where the length is read
> directly from req->dst_len rather than cached in a digest_size local.
> Mainline does not contain this code path; commit 1e562deacecc
> ("crypto: rsassa-pkcs1 - Migrate to sig_alg backend") removed
> pkcs1pad_verify() in v6.13-rc1.  This is a minimal fix for the
> affected stable branches.  The 6.1.y/6.6.y/6.12.y form
> (WARN_ON(!digest_size)) is sent as a separate patch.
> 
> Found by 0sec automated security-research tooling (https://0sec.ai).
> 
> Fixes: c7381b012872 ("crypto: akcipher - new verify API for public key algorithms")
> Cc: stable@xxxxxxxxxxxxxxx
> Assisted-by: 0sec:multi-model
> Signed-off-by: Doruk Tan Ozturk <doruk@xxxxxxx>

Reviewed-by: Lukas Wunner <lukas@xxxxxxxxx>