From nobody Mon Sep 28 21:53:46 2026 Received: from mail-wr1-f41.google.com (mail-wr1-f41.google.com [209.85.221.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id D70CA314A6F for ; Mon, 17 Aug 2026 04:27:37 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.41 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786940859; cv=none; b=iJs1limUPayP3WKaEVIV1y7zj4EM7IQMg3n6gpeIn1h5VQdHWe5eUg/K8Q5GguH4nFhBVE/v7n3zdXPnz9dB0CZmcDJHZnHJXrT2gtC6HdGC8hTa3kJaoA/0iV20P0ykpcP+NaALjuuLqT7psTxDU8Muy1mmaiBjEoG2QUJKw8U= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1786940859; c=relaxed/simple; bh=T5FP46jyxplehsCLTTV6ihDa25uz89wkt3oqqLQtX1o=; h=From:To:Cc:Subject:Date:Message-Id:MIME-Version; b=ZLpR8mEgo0rTPtXWFlWtNuTCCkvx13D0lsrlLoCCBKm+I8TAhdZWZGi5JVJWAOWdpxrmdFZ6txhjAcgWaIBWP0sQPRAM5Nx3z818f9xWbqMkrUUmzWK9aiH54CoG0z2aK6yhrTlbVw84yfDJLHB/bRO6N/QskWNayCP3J2ecg9E= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=dnQAUguV; arc=none smtp.client-ip=209.85.221.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="dnQAUguV" Received: by mail-wr1-f41.google.com with SMTP id ffacd0b85a97d-47db714766aso2299564f8f.0 for ; Sun, 16 Aug 2026 21:27:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1786940856; x=1787545656; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to:content-type; bh=wZ1x1M8Ws3tbIzXAIDE+DSbo/H7/Nn1lzkQP6Ct23jc=; b=dnQAUguVwamHM505+wRbU+AnlNM66pbvPhK8gm/RQ4fa5AqGQdVA7htpTWWQGeolLW Dd+CfhSvPvLG7T+H+6pkmgfvZ/xaXvQrCo4w+0mAqtD0Qx5bPeAqk5Z95hdLKPy6NtfO uTen5bbjO6vioQ0Qpr0TIwzVUDmwCW8WFEOGlQxx6Y+K/LaGxtwFwruyyFa/lZYRT5wg qjBXHxbI9oVPSt3o6TqCqbDdZhE3VNYOfxewrkL0oBT2bH1cmma7wizBm0jwpxoWjZkL zFey5EF36s/iflI8iiy97TNtbm+b6S7pTmnVkF+NfLonp5ZPYsM925m0PrSlRYcLA3ua v3CA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1786940856; x=1787545656; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to:content-type; bh=wZ1x1M8Ws3tbIzXAIDE+DSbo/H7/Nn1lzkQP6Ct23jc=; b=NkO+h24cCGYMCdeIyXYf5M/rjhSBREsIP1d8i4ViO49AqCoS4beuon2Z8PZBigxgvS Uuh8qWCdvbaGZZu2UREgL2TjzvQXQEAMg88pUWUyZI2tK00uFn3NRrNIhmaszEF0PYCU HY8ttEdeuBIiwvq7uybRAE12vJ6yrtbFSUMUNTf+ayljsDFovmXc/MWSIA+pqTtAugf1 QpUtYQx2fZgrwJBlKtraUHtLK6nO5eVjkgYvlxbiQrEohHnzUlMbVCkcqt+6SQGbgzIr C5SzHGBTBNXD8wL6fhSbwY8qf76simUucIh4YMm/XY8yMosepXdjn5cmjQJ3+yAdeO5X s8Fg== X-Forwarded-Encrypted: i=1; AHgh+RqR45OYrX0dNUlScoJL+MNUXaX7XKnjYvSIzfZp2qS6F2fHYGDnzub2WBqsxTeDAt2Tei0rWTcr2t1HzQQ=@vger.kernel.org X-Gm-Message-State: AOJu0YztWajydSUN2b2gXVt+CA8C6pySBYP+5ykZzQgbQipyhLp1D4Px 2De7aOANovO2zgGMBxNejJVQ1uv1OniYTulwfWRaEYvvETIgTKhVV+9V X-Gm-Gg: AR+sD111TK6vVyropiFOWE2RxqlQb6KFQ3TQLkdADiJX39cQJJThP3X1f5kgmyAYo23 O/R4NxPIoNtEnGzUq05aXiUSqCMxZpSlrpx/WSql9nt55pXcGvpY3ptweR6tCYPXLn2w1c56Op+ SNKXRDKZPpFQ+jBwIK/M4uOCEUXd1rzQuG5XJWrp+Fy2im5GTF4XFn9WPxoWt2AXG9DZjEr23RF riPcCNZE5E/m07bGTdD2cRQYq9GMvtY/o8TY5aasoildmie3fqJp8L5kWSBv9qv+4Uh1FgcxdNp De7mcaKbZ4WOrf0nMIivdF6SaKyjiIxsQMIRSFPG8rY+2KBj53y6Xm59ztmqlTI2Lx6J3oGy2p/ s0MaEMdnrAG7hvXrkNUgs3H37feIREDgeH9aZFhBzfCrlg0qKGA2vfHQCEVByLlMG/ephvhHGPo u2TWKrNX8HMDYLa1pix4Xao937wOf9QyAsEc3pH/cynpJAJclpMnr93+vuyC6AewgnE+DNC1F9Q Zz000lJdAGZYQ4LGtSQJ6apAPkvuoxrJVA51Q2ZYgqhNB/S1WDvcBgaJ8RyURWhwL9KcyD6pIMc m7UUZRlKZCupvaT8i4XRcPy+L5yAYun/qyGyegY= X-Received: by 2002:a05:6000:4108:b0:47f:8b0f:7172 with SMTP id ffacd0b85a97d-4815a4f9996mr39625297f8f.6.1786940855866; Sun, 16 Aug 2026 21:27:35 -0700 (PDT) Received: from localhost.localdomain (dynamic-095-114-219-094.95.114.pool.telefonica.de. [95.114.219.94]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-482a5b783d1sm584685f8f.25.2026.08.16.21.27.34 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Sun, 16 Aug 2026 21:27:35 -0700 (PDT) From: Karl Mehltretter To: Giovanni Cabiddu , Herbert Xu Cc: Karl Mehltretter , "David S . Miller" , Kees Cook , Xin Zeng , qat-linux@intel.com, linux-crypto@vger.kernel.org, linux-kernel@vger.kernel.org Subject: [RFC PATCH] crypto: qat - zero the VF migration state buffer on save Date: Mon, 17 Aug 2026 06:26:13 +0200 Message-Id: <20260817042613.19855-1-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" The migration buffer is only partially written but exposed at its full size. Unwritten bytes may contain stale heap contents or data from an earlier migration. Zero the buffer before saving setup and zero only the area after setup_size before saving state. Fixes: f0bbfc391aa7 ("crypto: qat - implement interface for live migration") Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter --- Found by review. Compile-tested only, I have no QAT hardware available. drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c b/driver= s/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c index bf2bae78a40d5..d8b961b2f2f7f 100644 --- a/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c +++ b/drivers/crypto/intel/qat/qat_common/adf_gen4_vf_mig.c @@ -837,6 +837,9 @@ static int adf_gen4_vfmig_save_state(struct qat_mig_dev= *mdev) return ret; } =20 + memset(mdev->state + mdev->setup_size, 0, + mdev->state_size - mdev->setup_size); + adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state + mdev->setup_size, mdev->state_size - mdev->setup_size); if (!adf_mstate_preamble_add(vfmig->mstate_mgr)) @@ -934,6 +937,8 @@ static int adf_gen4_vfmig_save_setup(struct qat_mig_dev= *mdev) if (mdev->setup_size) return 0; =20 + memset(mdev->state, 0, mdev->state_size); + adf_mstate_mgr_init(vfmig->mstate_mgr, mdev->state, mdev->state_size); if (!adf_mstate_preamble_add(vfmig->mstate_mgr)) return -EINVAL; --=20 2.53.0