[PATCH 0/2] KEYS: two fixes for the asymmetric keyctl operations

[PATCH 0/2] KEYS: two fixes for the asymmetric keyctl operations

[Florian Bauckholt via B4 Relay]

Hi,

two small fixes for KEYCTL_PKEY_VERIFY and KEYCTL_PKEY_DECRYPT that I
ran into while doing differential testing of crypto implementations
with the kernel hooked up via UML:

Patch 1 fixes a regression from commit cb481e59ea6c ("KEYS: fix overflow
in keyctl_pkey_params_get_2()"), which was tagged for stable:
KEYCTL_PKEY_VERIFY ignores the signature length passed by the caller.
It also is a prerequisite for making the x962 ECDSA template reject
signatures that are not DER-encoded, which I'm posting separately to
linux-crypto.

Patch 2 fixes PKCS#1 decryption of an empty message returning the
ciphertext.

Both changes were part of a patch posted by Hui Peng in September that
did not get a reply [1]. That patch also changed the out_len checks in
keyctl_pkey_params_get_2(), which is not included here.

Thanks!

[1] https://lore.kernel.org/all/20260919221742.3709658-1-benquike@gmail.com/

---
Florian Bauckholt (2):
      KEYS: fix signature length passed to KEYCTL_PKEY_VERIFY
      KEYS: asymmetric: Fix PKCS#1 decryption of an empty message

 crypto/asymmetric_keys/public_key.c | 6 +++---
 security/keys/keyctl_pkey.c         | 2 +-
 2 files changed, 4 insertions(+), 4 deletions(-)
---
base-commit: 6628e7d4c6b25c8d18f1345e3a20d21829aae7e4
change-id: 20261111-keyctl-pkey-fixes-26358a8707b6

Best regards,
--  
Florian Bauckholt <florian.bauckholt@cispa.de>

[PATCH 1/2] KEYS: fix signature length passed to KEYCTL_PKEY_VERIFY

[Florian Bauckholt via B4 Relay]

From: Florian Bauckholt <florian.bauckholt@cispa.de>

Commit cb481e59ea6c ("KEYS: fix overflow in keyctl_pkey_params_get_2()")
made keyctl_pkey_params_get_2() set params->out_len to the maximum
output size of the operation instead of the size provided by the caller.
It does so for KEYCTL_PKEY_VERIFY as well, but verify has no output
buffer: out_len shares a union with in2_len, the length of the
signature.

As a result keyctl_pkey_verify() ignores the signature length passed by
the caller. It copies max_sig_size bytes from the signature pointer and
passes max_sig_size as the signature size to the verification.

This makes no difference for signatures that are always max_sig_size
bytes long, such as RSA. A shorter signature, e.g. a DER-encoded ECDSA
signature, is followed by whatever is behind it in the caller's memory,
or the call fails with -EFAULT if that memory is not readable. The
x962 ECDSA template currently ignores data following the signature,
which hides the problem.

Use the length provided by the caller, which has already been checked
against max_sig_size.

Fixes: cb481e59ea6c ("KEYS: fix overflow in keyctl_pkey_params_get_2()")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/all/20260919221742.3709658-1-benquike@gmail.com/
Signed-off-by: Florian Bauckholt <florian.bauckholt@cispa.de>
---
 security/keys/keyctl_pkey.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/security/keys/keyctl_pkey.c b/security/keys/keyctl_pkey.c
index 15b6bf6399b5..794fa3d01911 100644
--- a/security/keys/keyctl_pkey.c
+++ b/security/keys/keyctl_pkey.c
@@ -160,7 +160,7 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par
 		    uparams.in2_len > info.max_sig_size)
 			return -EINVAL;
 
-		params->out_len = info.max_sig_size;
+		params->in2_len = uparams.in2_len;
 		break;
 	default:
 		return -EOPNOTSUPP;

-- 
2.56.0

[PATCH 2/2] KEYS: asymmetric: Fix PKCS#1 decryption of an empty message

[Florian Bauckholt via B4 Relay]

From: Florian Bauckholt <florian.bauckholt@cispa.de>

KEYCTL_PKEY_DECRYPT with enc=pkcs1 on a valid ciphertext of an empty
message returns the key size instead of 0, and the output buffer is
filled with the ciphertext.

crypto_akcipher_sync_encrypt() returns 0 on success, so
software_key_eds_op() maps a result of 0 to crypto_akcipher_maxsize().
The mapping is applied to decryption as well, but
crypto_akcipher_sync_decrypt() returns the length of the plaintext,
which is 0 for an empty message. By then crypto_akcipher_sync_post()
has copied its scratch buffer to the output. pkcs1pad copied nothing
into that buffer, so it still holds the ciphertext.

Only the caller's own input is returned, so nothing is disclosed, and
messages that are not empty are decrypted correctly. An empty message
is valid, though: RFC 8017 section 7.2 only limits the message length
to k - 11 octets.

Apply the mapping to encryption only.

Fixes: 63ba4d67594a ("KEYS: asymmetric: Use new crypto interface without scatterlists")
Cc: stable@vger.kernel.org # v6.5+
Link: https://lore.kernel.org/all/20260919221742.3709658-1-benquike@gmail.com/
Signed-off-by: Florian Bauckholt <florian.bauckholt@cispa.de>
---
 crypto/asymmetric_keys/public_key.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index 09a0b83d5d77..d71747d93b2c 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -341,6 +341,9 @@ static int software_key_eds_op(struct kernel_pkey_params *params,
 			break;
 		ret = crypto_akcipher_sync_encrypt(tfm, in, params->in_len,
 						   out, params->out_len);
+		/* Returns 0 on success and always fills the whole output. */
+		if (ret == 0)
+			ret = crypto_akcipher_maxsize(tfm);
 		break;
 	case kernel_pkey_decrypt:
 		if (issig)
@@ -358,9 +361,6 @@ static int software_key_eds_op(struct kernel_pkey_params *params,
 		BUG();
 	}
 
-	if (!issig && ret == 0)
-		ret = crypto_akcipher_maxsize(tfm);
-
 error_free_tfm:
 	if (issig)
 		crypto_free_sig(sig);

-- 
2.56.0