Catcrafts/milos-linux
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
milos-linux/lib
History
Lukas Wunner 30e513e755 lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() 
commit 8c2f128825 upstream.

Yiming reports an integer underflow in mpi_read_raw_from_sgl() when
subtracting "lzeros" from the unsigned "nbytes".

For this to happen, the scatterlist "sgl" needs to occupy more bytes
than the "nbytes" parameter and the first "nbytes + 1" bytes of the
scatterlist must be zero.  Under these conditions, the while loop
iterating over the scatterlist will count more zeroes than "nbytes",
subtract the number of zeroes from "nbytes" and cause the underflow.

When commit 2d4d1eea54 ("lib/mpi: Add mpi sgl helpers") originally
introduced the bug, it couldn't be triggered because all callers of
mpi_read_raw_from_sgl() passed a scatterlist whose length was equal to
"nbytes".

However since commit 63ba4d6759 ("KEYS: asymmetric: Use new crypto
interface without scatterlists"), the underflow can now actually be
triggered.  When invoking a KEYCTL_PKEY_ENCRYPT system call with a
larger "out_len" than "in_len" and filling the "in" buffer with zeroes,
crypto_akcipher_sync_prep() will create an all-zero scatterlist used for
both the "src" and "dst" member of struct akcipher_request and thereby
fulfil the conditions to trigger the bug:

  sys_keyctl()
    keyctl_pkey_e_d_s()
      asymmetric_key_eds_op()
        software_key_eds_op()
          crypto_akcipher_sync_encrypt()
            crypto_akcipher_sync_prep()
              crypto_akcipher_encrypt()
                rsa_enc()
                  mpi_read_raw_from_sgl()

To the user this will be visible as a DoS as the kernel spins forever,
causing soft lockup splats as a side effect.

Fix it.

Reported-by: Yiming Qian <yimingqian591@gmail.com> # off-list
Fixes: 2d4d1eea54 ("lib/mpi: Add mpi sgl helpers")
Signed-off-by: Lukas Wunner <lukas@wunner.de>
Cc: stable@vger.kernel.org # v4.4+
Reviewed-by: Ignat Korchagin <ignat@linux.win>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Link: https://lore.kernel.org/r/59eca92ff4f87e2081777f1423a0efaaadcfdb39.1776003111.git.lukas@wunner.de
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2026-05-14 15:31:13 +02:00
..
842
crc lib/crc: Switch ARM and arm64 to 'ksimd' scoped guard API 2025-11-12 09:52:01 +01:00
crypto lib/crypto: mpi: Fix integer underflow in mpi_read_raw_from_sgl() 2026-05-14 15:31:13 +02:00
dim Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
fonts lib/fonts: Add Terminus 10x18 console font 2025-12-02 19:57:01 +01:00
kunit kunit: reduce stack usage in kunit_run_tests() 2026-03-02 10:11:06 -07:00
lz4
lzo
math lib: test_mul_u64_u64_div_u64(): test the 32bit code on 64bit 2025-11-20 14:03:42 -08:00
pldmfw Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
raid6 First set of RISC-V updates for v6.19-rc1 2025-12-05 16:26:57 -08:00
reed_solomon Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_fortify fortify: Cleanup temp file also on non-successful exit 2026-01-14 19:49:55 -08:00
tests printf: Compile the kunit test with DISABLE_BRANCH_PROFILING DISABLE_BRANCH_PROFILING 2026-05-07 06:13:59 +02:00
vdso vdso/gettimeofday: Force inlining of __cvdso_clock_getres_common() 2026-01-26 22:27:07 +01:00
xz Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
zlib_deflate
zlib_dfltcc
zlib_inflate Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
zstd
.gitignore
alloc_tag.c mm/alloc_tag: clear codetag for pages allocated before page_ext initialization 2026-05-07 06:13:50 +02:00
argv_split.c
ashldi3.c
ashrdi3.c
asn1_decoder.c
asn1_encoder.c
assoc_array.c Convert more 'alloc_obj' cases to default GFP_KERNEL arguments 2026-02-21 20:03:00 -08:00
atomic64.c
atomic64_test.c
audit.c
base64.c lib/base64: rework encode/decode for speed and stricter validation 2025-11-20 14:03:44 -08:00
bcd.c
bch.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
bitmap-str.c
bitmap.c cpumask: Introduce cpumask_weighted_or() 2025-11-20 12:14:54 +01:00
bitrev.c
bootconfig-data.S
bootconfig.c lib/bootconfig: check xbc_init_node() return in override path 2026-03-19 08:43:05 +09:00
bsearch.c
btree.c
bucket_locks.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
bug.c bug: avoid format attribute warning for clang as well 2026-03-27 20:48:38 -07:00
build_OID_registry oid_registry: allow arbitrary size OIDs 2026-01-20 19:44:15 -08:00
buildid.c procfs: avoid fetching build ID while holding VMA lock 2026-02-05 14:10:00 -08:00
bust_spinlocks.c
cache_maint.c lib: Support ARCH_HAS_CPU_CACHE_INVALIDATE_MEMREGION 2025-11-21 18:42:01 +00:00
check_signature.c
checksum.c
closure.c
clz_ctz.c
clz_tab.c
cmdline.c
cmpdi2.c
cmpxchg-emu.c
codetag.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
compat_audit.c
cpu_rmap.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
cpumask.c
ctype.c
debug_info.c
debug_locks.c
debugobjects.c debugobject: Make it work with deferred page initialization - again 2026-02-10 13:26:19 +01:00
dec_and_lock.c compiler-context-analysis: Remove __cond_lock() function-like helper 2026-01-05 16:43:33 +01:00
decompress.c
decompress_bunzip2.c
decompress_inflate.c
decompress_unlz4.c
decompress_unlzma.c
decompress_unlzo.c
decompress_unxz.c xz: fix arm fdt compile error for kmalloc replacement 2026-02-22 12:05:31 -08:00
decompress_unzstd.c
devmem_is_allowed.c
devres.c
dhry.h
dhry_1.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
dhry_2.c
dhry_run.c
digsig.c integrity-v6.18 2025-10-05 10:48:33 -07:00
dump_stack.c
dynamic_debug.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
dynamic_queue_limits.c
earlycpio.c
errname.c
error-inject.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
errseq.c
extable.c
fault-inject-usercopy.c
fault-inject.c
fdt.c
fdt_addresses.c
fdt_empty_tree.c
fdt_ro.c
fdt_rw.c
fdt_strerror.c
fdt_sw.c
fdt_wip.c
find_bit.c lib/find_bit: fix uninitialized variable use in FIND_NTH_BIT 2026-02-08 18:47:29 -05:00
find_bit_benchmark.c
find_bit_benchmark_rust.rs
flex_proportions.c flex_proportions: make fprop_new_period() hardirq safe 2026-01-26 19:03:46 -08:00
fw_table.c
genalloc.c
generic-radix-tree.c
glob.c
group_cpus.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
hexdump.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
hweight.c bitops: Update kernel-doc in hweight.c to fix the issues with it 2025-11-06 11:51:04 -05:00
idr.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
inflate.c
interval_tree.c interval_tree: Fix ITSTATIC usage for *_subtree_search() 2025-10-14 14:45:22 -07:00
interval_tree_test.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
iomap.c
iomap_copy.c
iomem_copy.c
iommu-helper.c
iov_iter.c x86-64/arm64/powerpc: clean up and rename __copy_from_user_flushcache 2026-04-22 13:32:21 +02:00
irq_poll.c
irq_regs.c
is_single_threaded.c
kasprintf.c
Kconfig lib/glob: convert selftest to KUnit 2026-01-26 19:07:13 -08:00
Kconfig.debug A single fix for debugobjects. 2026-03-01 13:32:32 -08:00
Kconfig.kasan
Kconfig.kcsan
Kconfig.kfence
Kconfig.kgdb
Kconfig.kmsan KMSAN: Restore dynamic check for '-fsanitize=kernel-memory' 2025-10-27 16:22:02 -07:00
Kconfig.ubsan Kconfig.ubsan: Remove CONFIG_UBSAN_REPORT_FULL from documentation 2026-01-07 12:16:03 -08:00
kfifo.c kfifo: fix kmalloc_array_node() argument order 2026-01-26 19:07:09 -08:00
klist.c
kobject.c kernfs: pass struct ns_common instead of const void * for namespace tags 2026-04-09 14:36:52 +02:00
kobject_uevent.c kernfs: pass struct ns_common instead of const void * for namespace tags 2026-04-09 14:36:52 +02:00
kstrtox.c lib/kstrtox: fix kstrtobool() docstring to mention enabled/disabled 2026-01-26 19:07:10 -08:00
kstrtox.h
linear_ranges.c
list_debug.c
list_sort.c
llist.c
locking-selftest-hardirq.h
locking-selftest-mutex.h
locking-selftest-rlock-hardirq.h
locking-selftest-rlock-softirq.h
locking-selftest-rlock.h
locking-selftest-rsem.h
locking-selftest-rtmutex.h
locking-selftest-softirq.h
locking-selftest-spin-hardirq.h
locking-selftest-spin-softirq.h
locking-selftest-spin.h
locking-selftest-wlock-hardirq.h
locking-selftest-wlock-softirq.h
locking-selftest-wlock.h
locking-selftest-wsem.h
locking-selftest.c treewide: Remove in_irq() 2025-10-24 21:39:27 +02:00
lockref.c compiler-context-analysis: Remove __cond_lock() function-like helper 2026-01-05 16:43:33 +01:00
logic_iomem.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
logic_pio.c
lru_cache.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
lshrdi3.c
lwq.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
Makefile mm.git review status for linus..mm-nonmm-stable 2026-02-12 12:13:01 -08:00
maple_tree.c maple_tree: fix tracepoint string pointers 2025-11-09 21:19:45 -08:00
memcat_p.c
memory-notifier-error-inject.c
memregion.c
memweight.c
min_heap.c
muldi3.c
net_utils.c
netdev-notifier-error-inject.c
nlattr.c
nmi_backtrace.c
notifier-error-inject.c
notifier-error-inject.h
objagg.c Convert remaining multi-line kmalloc_obj/flex GFP_KERNEL uses 2026-02-22 08:26:33 -08:00
objpool.c objpool: fix the overestimation of object pooling metadata size 2026-02-12 15:45:57 -08:00
of-reconfig-notifier-error-inject.c
oid_registry.c
once.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
packing.c
packing_test.c
parman.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
parser.c
percpu-refcount.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
percpu_counter.c
percpu_test.c
plist.c treewide: Update email address 2026-01-11 06:09:11 -10:00
pm-notifier-error-inject.c
polynomial.c
radix-tree.c
radix-tree.h
random32.c
ratelimit.c lib: ratelimit: fix spelling mistake 'seperately' 2025-11-20 14:03:45 -08:00
rbtree.c rbtree: inline rb_last() 2025-11-27 14:24:30 -08:00
rbtree_test.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
rcuref.c
ref_tracker.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
refcount.c
rhashtable.c rhashtable: Enable context analysis 2026-01-05 16:43:35 +01:00
sbitmap.c
scatterlist.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
seq_buf.c
sg_pool.c
sg_split.c treewide: Replace kmalloc with kmalloc_obj for non-scalar types 2026-02-21 01:02:28 -08:00
siphash.c
smp_processor_id.c
sort.c
stackdepot.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
stmp_device.c
string.c
string_helpers.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
strncpy_from_user.c lib/strn*,uaccess: Use masked_user_{read/write}_access_begin when required 2025-11-18 15:27:35 +01:00
strnlen_user.c lib/strn*,uaccess: Use masked_user_{read/write}_access_begin when required 2025-11-18 15:27:35 +01:00
sys_info.c sys_info: add a default kernel sys_info mask 2025-11-20 14:03:43 -08:00
syscall.c
test-kstrtox.c
test_bitmap.c
test_bitops.c
test_bpf.c Convert 'alloc_flex' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_context-analysis.c compiler-context-analysis: Remove __assume_ctx_lock from initializers 2026-01-28 20:45:25 +01:00
test_debug_virtual.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_dynamic_debug.c
test_firmware.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_fpu.h
test_fpu_glue.c
test_fpu_impl.c
test_free_pages.c
test_hexdump.c
test_hmm.c lib: test_hmm: evict device pages on file close to avoid use-after-free 2026-05-07 06:13:43 +02:00
test_hmm_uapi.h lib/test_hmm: add large page allocation failure testing 2025-11-24 15:08:48 -08:00
test_ida.c
test_kho.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_kmod.c
test_lockup.c
test_maple_tree.c Summary of significant series in this pull request: 2025-10-02 18:18:33 -07:00
test_memcat_p.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_meminit.c
test_module.c
test_objagg.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_objpool.c
test_parman.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_ref_tracker.c
test_rhashtable.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_static_key_base.c
test_static_keys.c
test_sysctl.c
test_ubsan.c
test_vmalloc.c Convert 'alloc_obj' family to use the new default GFP_KERNEL argument 2026-02-21 17:09:51 -08:00
test_xarray.c
textsearch.c
timerqueue.c
trace_readwrite.c
ts_bm.c
ts_fsm.c
ts_kmp.c lib/ts_kmp: fix integer overflow in pattern length calculation 2026-05-07 06:13:48 +02:00
ubsan.c
ubsan.h
ucmpdi2.c
ucs2_string.c
union_find.c
usercopy.c uaccess: decouple INLINE_COPY_FROM_USER and CONFIG_RUST 2025-11-12 10:00:16 -08:00
uuid.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
vsprintf.c kernel.h: drop hex.h and update all hex.h users 2026-01-20 19:44:19 -08:00
win_minmax.c
xarray.c
xxhash.c lib/xxhash: remove more unused xxh functions 2025-11-12 10:00:17 -08:00