[PATCH 2/2] KEYS: asymmetric: Fix PKCS#1 decryption of an empty message

[Florian Bauckholt via B4 Relay <devnull+florian.bauckholt.cispa.de@kernel.org>]

From: Florian Bauckholt <florian.bauckholt@cispa.de>

KEYCTL_PKEY_DECRYPT with enc=pkcs1 on a valid ciphertext of an empty
message returns the key size instead of 0, and the output buffer is
filled with the ciphertext.

crypto_akcipher_sync_encrypt() returns 0 on success, so
software_key_eds_op() maps a result of 0 to crypto_akcipher_maxsize().
The mapping is applied to decryption as well, but
crypto_akcipher_sync_decrypt() returns the length of the plaintext,
which is 0 for an empty message. By then crypto_akcipher_sync_post()
has copied its scratch buffer to the output. pkcs1pad copied nothing
into that buffer, so it still holds the ciphertext.

Only the caller's own input is returned, so nothing is disclosed, and
messages that are not empty are decrypted correctly. An empty message
is valid, though: RFC 8017 section 7.2 only limits the message length
to k - 11 octets.

Apply the mapping to encryption only.

Fixes: 63ba4d67594a ("KEYS: asymmetric: Use new crypto interface without scatterlists")
Cc: stable@vger.kernel.org # v6.5+
Link: https://lore.kernel.org/all/20260919221742.3709658-1-benquike@gmail.com/
Signed-off-by: Florian Bauckholt <florian.bauckholt@cispa.de>
---
 crypto/asymmetric_keys/public_key.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/crypto/asymmetric_keys/public_key.c b/crypto/asymmetric_keys/public_key.c
index 09a0b83d5d77..d71747d93b2c 100644
--- a/crypto/asymmetric_keys/public_key.c
+++ b/crypto/asymmetric_keys/public_key.c
@@ -341,6 +341,9 @@ static int software_key_eds_op(struct kernel_pkey_params *params,
 			break;
 		ret = crypto_akcipher_sync_encrypt(tfm, in, params->in_len,
 						   out, params->out_len);
+		/* Returns 0 on success and always fills the whole output. */
+		if (ret == 0)
+			ret = crypto_akcipher_maxsize(tfm);
 		break;
 	case kernel_pkey_decrypt:
 		if (issig)
@@ -358,9 +361,6 @@ static int software_key_eds_op(struct kernel_pkey_params *params,
 		BUG();
 	}
 
-	if (!issig && ret == 0)
-		ret = crypto_akcipher_maxsize(tfm);
-
 error_free_tfm:
 	if (issig)
 		crypto_free_sig(sig);

-- 
2.56.0