github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 09:36:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

s390 updates for 7.2-rc2

Browse Source 
- Fix PKEY_VERIFYPROTK ioctl key type handling by removing the generic
   key-length based type check with its wrong bit-size calculation,
   and leaving protected key verification to the pkey handler
 
 - Fix monwriter buffer reuse by rejecting records that change the data
   length, preventing out of bounds user copy into the kernel buffer
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEE3QHqV+H2a8xAv27vjYWKoQLXFBgFAmpJMw4ACgkQjYWKoQLX
 FBg7mwf/V8AKr7uPTvCMEvPUrgFPz1NWE0Eg4UZb5WYoToP6HwMMJpkkBcuWDcpT
 L7UVkXczlzhd4QqjftmVSVd8ea3MT+IZQ8W6TVEM+zgu3kYuLT0JC2POUTwIS5D+
 boYruqFfH4Cn2DRacOEV8dRfHNVyrZ4MdWEQnHTtJ0n6dxT1O93aH4YfAPhRrT57
 LEf4PnnWTza/xWF5Huyk5pXmNjrwsF63djwh7YSHIOxMfG4mK3h/cQzu/sEwKMWs
 Q5wPqhl8U20WG8fc8bi+VpfEI/v7ajjZm7mIYC09t2ymVSqz85wzaDk9igeSvv7i
 bsy26udNG4XjmwFNbJSz8JOyaph8LA==
 =AWqj
 -----END PGP SIGNATURE-----

Merge tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux

Pull s390 fixes from Vasily Gorbik:

 - Fix PKEY_VERIFYPROTK ioctl key type handling by removing the generic
   key-length based type check with its wrong bit-size calculation, and
   leaving protected key verification to the pkey handler

 - Fix monwriter buffer reuse by rejecting records that change the data
   length, preventing out of bounds user copy into the kernel buffer

* tag 's390-7.2-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390/monwriter: Reject buffer reuse with different data length
  pkey: Move keytype check from pkey api to handler
This commit is contained in:
Linus Torvalds 2026-07-04 06:28:45 -10:00
commit 7404ce5163
2 changed files with 4 additions and 10 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/s390/char/monwriter.c
View File

@ -122,6 +122,9 @@ static int monwrite_new_hdr(struct mon_private *monpriv)
kfree(monbuf->data);
kfree(monbuf);
monbuf = NULL;
} else if (monbuf->hdr.datalen != monhdr->datalen) {
/* Data with buffer reuse must not change its length */
return -EINVAL;
}
} else if (monhdr->mon_function != MONWRITE_STOP_INTERVAL) {
if (mon_buf_count >= mon_max_bufs)

11
drivers/s390/crypto/pkey_api.c
View File

@ -327,7 +327,6 @@ static int pkey_ioctl_verifyprotk(struct pkey_verifyprotk __user *uvp)
{
struct pkey_verifyprotk kvp;
struct protaeskeytoken *t;
u32 keytype;
u8 *tmpbuf;
int rc;
@ -341,14 +340,6 @@ static int pkey_ioctl_verifyprotk(struct pkey_verifyprotk __user *uvp)
return -EINVAL;
}
keytype = pkey_aes_bitsize_to_keytype(8 * kvp.protkey.len);
if (!keytype) {
PKEY_DBF_ERR("%s unknown/unsupported protkey length %u\n",
__func__, kvp.protkey.len);
memzero_explicit(&kvp, sizeof(kvp));
return -EINVAL;
}
/* build a 'protected key token' from the raw protected key */
tmpbuf = kzalloc(sizeof(*t), GFP_KERNEL);
if (!tmpbuf) {
@ -358,7 +349,7 @@ static int pkey_ioctl_verifyprotk(struct pkey_verifyprotk __user *uvp)
t = (struct protaeskeytoken *)tmpbuf;
t->type = TOKTYPE_NON_CCA;
t->version = TOKVER_PROTECTED_KEY;
t->keytype = keytype;
t->keytype = kvp.protkey.type;
t->len = kvp.protkey.len;
memcpy(t->protkey, kvp.protkey.protkey, kvp.protkey.len);