In attach_auth_trunc(), userspace supplies `ualg->alg_trunc_len` (in bits) via XFRMA_ALG_AUTH_TRUNC, and attach_auth_trunc() only checks that `ualg->alg_trunc_len <= algo->uinfo.auth.icv_fullbits`. However, ESP and AH convert `alg_trunc_len` to bytes via `esp_authsize = ALIGN(x->aalg->alg_trunc_len, 8) >> 3` or `ah_authsize = x->aalg->alg_trunc_len >> 3`, and pass `authsize` to `crypto_aead_setauthsize()` or `ah_init_state()`. If `alg_trunc_len` is not a multiple of 8 bits (or is between 1 and 31 bits), integer division by 8 truncates the requested bit length (for example, `alg_trunc_len == 7` yields a 0-byte ICV in AH, or `alg_trunc_len` not divisible by 8 mismatches the ICV byte length between AH and ESP). Reject `alg_trunc_len` values that are not a multiple of 8 bits (`ualg->alg_trunc_len & 7`) or non-zero values smaller than 32 bits (`ualg->alg_trunc_len > 0 && ualg->alg_trunc_len < 32`) with `-EINVAL`. Fixes: 4447bb33f094 ("xfrm: Store aalg in xfrm_state with a user specified truncation length") Assisted-by: LLM Signed-off-by: Hui Peng --- net/xfrm/xfrm_user.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c index a2587c7e796b..d56a0095113b 100644 --- a/net/xfrm/xfrm_user.c +++ b/net/xfrm/xfrm_user.c @@ -698,7 +698,9 @@ static int attach_auth_trunc(struct xfrm_algo_auth **algpp, u8 *props, NL_SET_ERR_MSG(extack, "Requested AUTH_TRUNC algorithm not found"); return -ENOSYS; } - if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits) { + if (ualg->alg_trunc_len > algo->uinfo.auth.icv_fullbits || + (ualg->alg_trunc_len & 7) || + (ualg->alg_trunc_len > 0 && ualg->alg_trunc_len < 32)) { NL_SET_ERR_MSG(extack, "Invalid length requested for truncated ICV"); return -EINVAL; } -- 2.55.0.1082.g2b9226bbc0-goog