From baff597605a973ca92d57a1a728db98d9c2b680e Mon Sep 17 00:00:00 2001 From: zhenwei pi Date: Sun, 21 Dec 2025 10:43:21 +0800 Subject: [PATCH] cryptodev-builtin: Limit the maximum size MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This backend driver is used for demonstration purposes only, unlimited size leads QEMU OOM. CVE: CVE-2025-14876 Upstream-Status: Backport [https://gitlab.com/qemu-project/qemu/-/commit/51514aa3c2f1e072c9728c975865e0b247b2619b] Fixes: CVE-2025-14876 Fixes: 1653a5f3fc7 ("cryptodev: introduce a new cryptodev backend") Reported-by: 이재영 Signed-off-by: zhenwei pi Reviewed-by: Michael S. Tsirkin Signed-off-by: Michael S. Tsirkin Message-Id: <20251221024321.143196-3-zhenwei.pi@linux.dev> (cherry picked from commit 7b913094c703641a0442bb1d1165323a019c591c) Signed-off-by: Michael Tokarev (cherry picked from commit 51514aa3c2f1e072c9728c975865e0b247b2619b) Signed-off-by: Ashishkumar Parmar --- backends/cryptodev-builtin.c | 9 +++------ 1 file changed, 3 insertions(+), 6 deletions(-) diff --git a/backends/cryptodev-builtin.c b/backends/cryptodev-builtin.c index 0414c01e0..55a3fbd27 100644 --- a/backends/cryptodev-builtin.c +++ b/backends/cryptodev-builtin.c @@ -53,6 +53,8 @@ typedef struct CryptoDevBackendBuiltinSession { #define CRYPTODEV_BUITLIN_MAX_AUTH_KEY_LEN 512 #define CRYPTODEV_BUITLIN_MAX_CIPHER_KEY_LEN 64 +/* demonstration purposes only, use a limited size to avoid QEMU OOM */ +#define CRYPTODEV_BUITLIN_MAX_REQUEST_SIZE (1024 * 1024) struct CryptoDevBackendBuiltin { CryptoDevBackend parent_obj; @@ -98,12 +100,7 @@ static void cryptodev_builtin_init( 1u << QCRYPTODEV_BACKEND_SERVICE_TYPE_MAC; backend->conf.cipher_algo_l = 1u << VIRTIO_CRYPTO_CIPHER_AES_CBC; backend->conf.hash_algo = 1u << VIRTIO_CRYPTO_HASH_SHA1; - /* - * Set the Maximum length of crypto request. - * Why this value? Just avoid to overflow when - * memory allocation for each crypto request. - */ - backend->conf.max_size = LONG_MAX - sizeof(CryptoDevBackendOpInfo); + backend->conf.max_size = CRYPTODEV_BUITLIN_MAX_REQUEST_SIZE; backend->conf.max_cipher_key_len = CRYPTODEV_BUITLIN_MAX_CIPHER_KEY_LEN; backend->conf.max_auth_key_len = CRYPTODEV_BUITLIN_MAX_AUTH_KEY_LEN; cryptodev_builtin_init_akcipher(backend);