Re: [PATCH] crypto: virtio: validate akcipher completion length

[Jérémy Jean]

On 2026-09-08 11:20, Herbert Xu wrote:
> On Fri, Aug 21, 2026 at 09:55:12AM +0000, Jérémy Jean wrote:
> > The device controls the used length returned for an akcipher request.
> > Subtracting the status byte without validating that length can 
> > underflow
> > dst_len, while accepting a payload larger than the submitted 
> > destination
> > can make sg_copy_from_buffer() read past the response buffer.
> >
> > Reject malformed completion lengths before updating dst_len or copying 
> > the
> > response.
> >
> > Fixes: a36bd0ad9fbf ("virtio-crypto: adjust dst_len at ops callback")
> > Assisted-by: Codex:gpt-5
> > Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
> > ---
> >  drivers/crypto/virtio/virtio_crypto_akcipher_algs.c | 13 
> > ++++++++++++-
> >  1 file changed, 12 insertions(+), 1 deletion(-)
> >
> > diff --git a/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c 
> > b/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
> > index d8d452cac391..886032abae80 100644
> > --- a/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
> > +++ b/drivers/crypto/virtio/virtio_crypto_akcipher_algs.c
> > @@ -69,6 +69,7 @@ static void 
> > virtio_crypto_dataq_akcipher_callback(struct virtio_crypto_request *
> >  	struct akcipher_request *akcipher_req =
> >  		container_of((void *)vc_akcipher_req, struct akcipher_request,
> >  			     __ctx);
> > +	unsigned int dst_len;
> >  	int error;
> >
> >  	switch (vc_req->status) {
> > @@ -88,9 +89,19 @@ static void 
> > virtio_crypto_dataq_akcipher_callback(struct virtio_crypto_request *
> >  	}
> >
> >  	/* actual length may be less than dst buffer */
> > -	akcipher_req->dst_len = len - sizeof(vc_req->status);
>
> This appears to have already been fixed by
>
> commit f77a956f6a19f9463ef1527c9d0cda50dded6b92
> Author: Bryam Vargas <hexlabsecurity@xxxxxxxxx>
> Date:   Mon Jun 22 01:52:15 2026 -0500
>
>     crypto: virtio - bound the akcipher result length
>
> Please check that commit and see if it's sufficient or not.
>
> Thanks,

Hello,

Indeed, this fixes the bug.
Thanks for the pointer, I missed that patch.

Regards,
Jérémy