xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

s390/zcrypt: add copy_from_user length plausibility checks

Browse Source 
There have been identified some places in the zcrypt
device driver where copy_from_user() is called but the
length value is not explicitly checked.

So now some plausibility checks and comments have been
introduced there.

Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Acked-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
Harald Freudenberger
2018-06-27 09:50:43 +02:00
committed by Martin Schwidefsky
parent ad82a928eb
commit 1fee96264a
2 changed files with 37 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

20
drivers/s390/crypto/zcrypt_cca_key.h
View File

@@ -99,7 +99,7 @@ struct cca_pvt_ext_CRT_sec {
* @mex: pointer to user input data
* @p: pointer to memory area for the key
*
* Returns the size of the key area or -EFAULT
* Returns the size of the key area or negative errno value.
*/
static inline int zcrypt_type6_mex_key_en(struct ica_rsa_modexpo *mex, void *p)
{
@@ -118,6 +118,15 @@ static inline int zcrypt_type6_mex_key_en(struct ica_rsa_modexpo *mex, void *p)
unsigned char *temp;
int i;
/*
* The inputdatalength was a selection criteria in the dispatching
* function zcrypt_rsa_modexpo(). However, do a plausibility check
* here to make sure the following copy_from_user() can't be utilized
* to compromise the system.
*/
if (WARN_ON_ONCE(mex->inputdatalength > 512))
return -EINVAL;
memset(key, 0, sizeof(*key));
key->pubHdr = static_pub_hdr;
@@ -178,6 +187,15 @@ static inline int zcrypt_type6_crt_key(struct ica_rsa_modexpo_crt *crt, void *p)
struct cca_public_sec *pub;
int short_len, long_len, pad_len, key_len, size;
/*
* The inputdatalength was a selection criteria in the dispatching
* function zcrypt_rsa_crt(). However, do a plausibility check
* here to make sure the following copy_from_user() can't be utilized
* to compromise the system.
*/
if (WARN_ON_ONCE(crt->inputdatalength > 512))
return -EINVAL;
memset(key, 0, sizeof(*key));
short_len = (crt->inputdatalength + 1) / 2;