From 79198067bdf027f5d4d5e2804b086a0a37b277ec Mon Sep 17 00:00:00 2001 From: Stephan Mueller Date: Fri, 3 Apr 2026 17:43:05 +0200 Subject: [PATCH] fix kernel invocation Signed-off-by: Stephan Mueller (cherry picked from commit d9f16d5fbcf8270110a8f6f35523525f345ca311) CVE: CVE-2026-71226 Upstream-Status: Backport [https://github.com/smuellerDD/libkcapi/commit/d9f16d5fbcf8270110a8f6f35523525f345ca311] Signed-off-by: Ankur Tyagi --- lib/kcapi-kernel-if.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/lib/kcapi-kernel-if.c b/lib/kcapi-kernel-if.c index b37f0dc..5d3b352 100644 --- a/lib/kcapi-kernel-if.c +++ b/lib/kcapi-kernel-if.c @@ -216,7 +216,7 @@ ssize_t _kcapi_common_send_meta(struct kcapi_handle *handle, } header->cmsg_level = SOL_ALG; header->cmsg_type = ALG_SET_IV; - header->cmsg_len = CMSG_LEN(iv_msg_size); + header->cmsg_len = kcapi_downcast_socklen_t(iv_msg_size); alg_iv = (void*)CMSG_DATA(header); alg_iv->ivlen = tfm->info.ivsize; memcpy(alg_iv->iv, handle->cipher.iv, tfm->info.ivsize); @@ -411,6 +411,7 @@ ssize_t _kcapi_common_vmsplice_chunk(struct kcapi_handle *handle, if (ret == 0) return -EPIPE; + processed += ret; inlen -= (size_t)ret; } @@ -436,7 +437,7 @@ int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread, for (i = 0; i < rc; i++) { struct iocb *cb; - unsigned int idx = (unsigned int)events[i].data; + uint64_t idx = events[i].data; if (idx >= KCAPI_AIO_CONCURRENT) return -EOVERFLOW; @@ -459,8 +460,7 @@ int _kcapi_aio_read_all(struct kcapi_handle *handle, size_t toread, if (events[i].res > 0) { handle->aio.iocb_ret[idx] = events[i].res; } else { - handle->aio.iocb_ret[idx] = - (__s64)cb->aio_nbytes; + handle->aio.iocb_ret[idx] = (__s64)cb->aio_nbytes; } cb->aio_fildes = 0;