linux-stable.git/crypto, branch v6.12.86

crypto: authencesn - reject short ahash digests during instance creation

2026-05-07T04:09:47+00:00

commit 5db6ef9847717329f12c5ea8aba7e9f588a980c0 upstream.

authencesn requires either a zero authsize or an authsize of at least
4 bytes because the ESN encrypt/decrypt paths always move 4 bytes of
high-order sequence number data at the end of the authenticated data.

While crypto_authenc_esn_setauthsize() already rejects explicit
non-zero authsizes in the range 1..3, crypto_authenc_esn_create()
still copied auth->digestsize into inst->alg.maxauthsize without
validating it.  The AEAD core then initialized the tfm's default
authsize from that value.

As a result, selecting an ahash with digest size 1..3, such as
cbcmac(cipher_null), exposed authencesn instances whose default
authsize was invalid even though setauthsize() would have rejected the
same value.  AF_ALG could then trigger the ESN tail handling with a
too-short tag and hit an out-of-bounds access.

Reject authencesn instances whose ahash digest size is in the invalid
non-zero range 1..3 so that no tfm can inherit an unsupported default
authsize.

Fixes: f15f05b0a5de ("crypto: ccm - switch to separate cbcmac driver")
Cc: stable@kernel.org
Reported-by: Yifan Wu 
Reported-by: Juefei Pu 
Co-developed-by: Yuan Tan 
Signed-off-by: Yuan Tan 
Suggested-by: Xin Liu 
Tested-by: Yuhang Zheng 
Reviewed-by: Eric Biggers 
Signed-off-by: Yucheng Lu 
Signed-off-by: Ren Wei 
Signed-off-by: Herbert Xu 
Signed-off-by: Greg Kroah-Hartman

crypto: pcrypt - Fix handling of MAY_BACKLOG requests

2026-05-07T04:09:27+00:00

commit 915b692e6cb723aac658c25eb82c58fd81235110 upstream.

MAY_BACKLOG requests can return EBUSY.  Handle them by checking
for that value and filtering out EINPROGRESS notifications.

Reported-by: Yiming Qian 
Fixes: 5a1436beec57 ("crypto: pcrypt - call the complete function on error")
Signed-off-by: Herbert Xu 
Cc: Eric Biggers 
Signed-off-by: Greg Kroah-Hartman

crypto: af_alg - Fix page reassignment overflow in af_alg_pull_tsgl

2026-04-30T09:14:47+00:00

commit 31d00156e50ecad37f2cb6cbf04aaa9a260505ef upstream.

When page reassignment was added to af_alg_pull_tsgl the original
loop wasn't updated so it may try to reassign one more page than
necessary.

Add the check to the reassignment so that this does not happen.

Also update the comment which still refers to the obsolete offset
argument.

Reported-by: syzbot+d23888375c2737c17ba5@syzkaller.appspotmail.com
Fixes: e870456d8e7c ("crypto: algif_skcipher - overhaul memory management")
Signed-off-by: Herbert Xu 
Signed-off-by: Eric Biggers 
Signed-off-by: Greg Kroah-Hartman

crypto: authencesn - Fix src offset when decrypting in-place

2026-04-30T09:14:46+00:00

commit 1f48ad3b19a9dfc947868edda0bb8e48e5b5a8fa upstream.

The src SG list offset wasn't set properly when decrypting in-place,
fix it.

Reported-by: Wolfgang Walter 
Fixes: e02494114ebf ("crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption")
Signed-off-by: Herbert Xu 
Signed-off-by: Eric Biggers 
Signed-off-by: Greg Kroah-Hartman

crypto: authencesn - Do not place hiseq at end of dst for out-of-place decryption

2026-04-30T09:14:46+00:00

commit e02494114ebf7c8b42777c6cd6982f113bfdbec7 upstream.

When decrypting data that is not in-place (src != dst), there is
no need to save the high-order sequence bits in dst as it could
simply be re-copied from the source.

However, the data to be hashed need to be rearranged accordingly.

Reported-by: Taeyang Lee <0wn@theori.io>
Fixes: 104880a6b470 ("crypto: authencesn - Convert to new AEAD interface")
Signed-off-by: Herbert Xu 
Signed-off-by: Eric Biggers 
Signed-off-by: Greg Kroah-Hartman

crypto: authenc - use memcpy_sglist() instead of null skcipher

2026-04-30T09:14:46+00:00

commit dbc4b1458e931e47198c3165ff5853bc1ad6bd7a upstream.

For copying data between two scatterlists, just use memcpy_sglist()
instead of the so-called "null skcipher".  This is much simpler.

Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu 
Signed-off-by: Eric Biggers 
Signed-off-by: Greg Kroah-Hartman

crypto: algif_aead - snapshot IV for async AEAD requests

2026-04-30T09:14:46+00:00

commit 5aa58c3a572b3e3b6c786953339f7978b845cc52 upstream.

AF_ALG AEAD AIO requests currently use the socket-wide IV buffer during
request processing.  For async requests, later socket activity can
update that shared state before the original request has fully
completed, which can lead to inconsistent IV handling.

Snapshot the IV into per-request storage when preparing the AEAD
request, so in-flight operations no longer depend on mutable socket
state.

Fixes: d887c52d6ae4 ("crypto: algif_aead - overhaul memory management")
Cc: stable@kernel.org
Reported-by: Yuan Tan 
Reported-by: Yifan Wu 
Reported-by: Juefei Pu 
Reported-by: Xin Liu 
Co-developed-by: Luxing Yin 
Signed-off-by: Luxing Yin 
Tested-by: Yucheng Lu 
Signed-off-by: Douya Le 
Signed-off-by: Ren Wei 
Signed-off-by: Herbert Xu 
Signed-off-by: Eric Biggers 
Signed-off-by: Greg Kroah-Hartman

crypto: algif_aead - Revert to operating out-of-place

2026-04-30T09:14:46+00:00

commit a664bf3d603dc3bdcf9ae47cc21e0daec706d7a5 upstream.

This mostly reverts commit 72548b093ee3 except for the copying of
the associated data.

There is no benefit in operating in-place in algif_aead since the
source and destination come from different mappings.  Get rid of
all the complexity added for in-place operation and just copy the
AD directly.

Fixes: 72548b093ee3 ("crypto: algif_aead - copy AAD from src to dst")
Reported-by: Taeyang Lee <0wn@theori.io>
Signed-off-by: Herbert Xu 
Signed-off-by: Eric Biggers 
Signed-off-by: Greg Kroah-Hartman

crypto: algif_aead - use memcpy_sglist() instead of null skcipher

2026-04-30T09:14:46+00:00

commit f2804d0eee8ddd57aa79d0b82872b74c21e1b69b upstream.

For copying data between two scatterlists, just use memcpy_sglist()
instead of the so-called "null skcipher".  This is much simpler.

Signed-off-by: Eric Biggers 
Signed-off-by: Herbert Xu 
Signed-off-by: Eric Biggers 
Signed-off-by: Greg Kroah-Hartman

crypto: scatterwalk - Backport memcpy_sglist()

2026-04-30T09:14:46+00:00

This backports the current implementation of memcpy_sglist() from
upstream commit 4dffc9bbffb9ccfcda730d899c97c553599e7ca8.

This function was rewritten twice.  The earlier implementations had many
prerequisite commits, while the latest implementation is standalone.
It's much easier to just backport the latest code directly.

Signed-off-by: Eric Biggers 
Signed-off-by: Greg Kroah-Hartman