[PATCH 07/14] vhost/crypto: catch incorrect request length

[Maxime Coquelin]

From: David Marchand <david.marchand at redhat.com>

Incorrect lengths expressed as 32 bit unsigned integers in the crypto
operation request could go unnoticed as those were summed in a too
narrow 32 bit unsigned integer.

This issue was not fixed by the previous fixes (under CVE-2020-14376
and CVE-2020-14378).

CVE-2026-86849
Bugzilla ID: 2022

Fixes: 3bb595ecd682 ("vhost/crypto: add request handler")
Cc: stable at dpdk.org

Acked-by: Bruce Richardson <bruce.richardson at intel.com>
Signed-off-by: David Marchand <david.marchand at redhat.com>
---
 lib/vhost/vhost_crypto.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/vhost/vhost_crypto.c b/lib/vhost/vhost_crypto.c
index 351fa241c8..bba2e1c0a6 100644
--- a/lib/vhost/vhost_crypto.c
+++ b/lib/vhost/vhost_crypto.c
@@ -1182,11 +1182,11 @@ vhost_crypto_check_chain_request(struct virtio_crypto_alg_chain_data_req *req)
 		(req->para.hash_start_src_offset <
 			VHOST_CRYPTO_MAX_DATA_SIZE) &&
 		(req->para.len_to_hash <= VHOST_CRYPTO_MAX_DATA_SIZE) &&
-		(req->para.cipher_start_src_offset + req->para.len_to_cipher <=
+		((uint64_t)req->para.cipher_start_src_offset + req->para.len_to_cipher <=
 			req->para.src_data_len) &&
-		(req->para.hash_start_src_offset + req->para.len_to_hash <=
+		((uint64_t)req->para.hash_start_src_offset + req->para.len_to_hash <=
 			req->para.src_data_len) &&
-		(req->para.dst_data_len + req->para.hash_result_len <=
+		((uint64_t)req->para.dst_data_len + req->para.hash_result_len <=
 			VHOST_CRYPTO_MAX_DATA_SIZE)))
 		return VIRTIO_CRYPTO_OK;
 	return VIRTIO_CRYPTO_BADMSG;
-- 
2.56.0