[dgarske]

Description

Fixes to the Intel QuickAssist port:

• Use-after-free in IntelQaRealloc(): making a DMA copy of a caller's buffer freed the caller's original, so every offloaded AES-GCM record freed ssl->encrypt.nonce and later used and freed it again. Regression in 5.9.4. Only the DMA copy types now keep the caller's buffer; any other type is a normal realloc.
• DH agree: the QAT path skipped the input checks the software path makes, so peer values of 0, 1, p-1 and p returned success. It now runs the same checks before offloading. IntelQaDhAgreeCallback() also read one byte past the output on an all-zero secret, and now rejects a zero or one secret.
• RSA prime generation: the carry loop in IntelQaGenPrime() indexed with i instead of j. This broke the carry and, for RSA-1024 and smaller, wrote past the candidate buffer.
• DRBG: IntelQaDrbg() sized chunks from the previous chunk instead of the remaining length, overrunning the output for requests over 128KB. Later chunks also used a freed buffer.
• README: building the QAT driver on Linux 7.0, rebuilding after a kernel upgrade, and recovering when the driver cannot get contiguous memory.

Fixes zd22732 (use-after-free), zd22754 and F-9981 (DH agree). DH agree reported by Md. Raisul Islam Mobin (https://mobin.tech | @mobin2021).

Testing

On a C62x with QAT 4.28: testwolfcrypt, including new tests for the DMA copy and for invalid DH peer values, plus TLS 1.3 hybrid ML-KEM, TLS 1.3 FFDHE and TLS 1.2 DHE handshakes with renegotiation, bulk transfers, and RSA-1024 and RSA-2048 key generation. The use-after-free was confirmed with AddressSanitizer against OpenSSL 3.5 clients. The DRBG change is only built for QAT 1.7 and was not compiled or run.

Checklist

• added tests
• updated/added doxygen
• updated appropriate READMEs
• Updated manual and documentation

[github-actions]

MemBrowse Memory Report · Explore what changed →

zephyr-frdm_rw612

• FLASH: log_const_area -8 B, rodata -8 B, text +1,592 B (+0.6%, 284,040 B / 67,108,864 B, total: 0% used)

No memory changes detected for:

• gcc-arm-cortex-m0plus
• gcc-arm-cortex-m3
• gcc-arm-cortex-m4
• gcc-arm-cortex-m4-baremetal
• gcc-arm-cortex-m4-crypto-only
• gcc-arm-cortex-m4-dtls13
• gcc-arm-cortex-m4-min-ecc
• gcc-arm-cortex-m4-openssl-compat
• gcc-arm-cortex-m4-pkcs7
• gcc-arm-cortex-m4-pq
• gcc-arm-cortex-m4-rsa-only
• gcc-arm-cortex-m4-sp-math
• gcc-arm-cortex-m4-tls12
• gcc-arm-cortex-m4-tls13
• gcc-arm-cortex-m7
• gcc-arm-cortex-m7-pq
• gcc-arm-cortex-m7-tls13
• stm32-sim-stm32h753

---

_{Catch memory regressions in CI with MemBrowse. Free for open source.}

[Copilot]

🟡 Changes recommended

The change can cause intermittent DH test failures and leak public-key buffers during resizing when QAT is unavailable.

2 open issues

• Preserve realloc ownership for non-DMA public-key buffers · New
• Fill the full public-key buffer for short generated keys · New

What changed in this PR

This PR addresses memory-safety and cryptographic correctness issues in wolfCrypt’s Intel QuickAssist offload support.

Changes:

• Updates DMA-copy ownership, RSA prime carry handling, and DRBG chunking.
• Adds DH input and shared-secret validation, plus regression tests.
• Documents QAT driver rebuilds, Linux 7.0 compatibility, and memory-allocation recovery.

File	Description
wolfcrypt/​test/​test.c	Adds DMA-copy ownership and invalid DH peer-value tests.
wolfcrypt/​src/​port/​intel/​README.md	Adds driver build and recovery guidance.
wolfcrypt/​src/​port/​intel/​quickassist.c	Corrects RSA carry indexing, DH output handling, and DRBG buffers.
wolfcrypt/​src/​port/​intel/​quickassist_mem.c	Preserves caller-owned buffers during DMA copies.
wolfcrypt/​src/​dh.c	Validates DH inputs before QAT offload.

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12029

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfcrypt-port-bugs
Not reviewed (no scan target covers them): wolfcrypt/src/port/intel/README.md
Coverage: 4 of 4 in-scope changed file(s) opened by the reviewer

Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)

This review was generated automatically by Fenrir. Reported findings require changes before merge.

Review tier: Max

[Copilot]

🟡 Changes recommended

The rollover path leaves the low byte at 0xFF, turning 12FF into 13FF instead of 1301 and advancing prime candidates by 256 rather than 2.

1 open issue

• Reset the low byte when propagating rollover carry · New

2 resolved since last review

• Fill the full public-key buffer for short generated keys
• Preserve realloc ownership for non-DMA public-key buffers

_{Review effort: Balanced}

[wolfSSL-Fenrir-bot]

Fenrir Automated Review — PR #12029

Scan targets checked: wolfcrypt-src, wolfcrypt-bugs, wolfcrypt-port-bugs
Not reviewed (no scan target covers them): wolfcrypt/src/port/intel/README.md
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer

Fenrir result: Approved ✅

No new issues found in the changed files.

Advisory only — this automated result does not count as a GitHub approval.

Review tier: Lite

Fenrir's latest completed scan found no issues; clearing the prior automated change request.