github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-07-27 17:47:41 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

s390/pkey: Check length in PKEY_VERIFYPROTK ioctl

Browse Source 
Explicitly check the buffer length request structure provided by
user-space and fail, if it exceeds the buffer size.

Cc: stable@vger.kernel.org
Fixes: 8fcc231ce3 ("s390/pkey: Introduce pkey base with handler registry and handler modules")
Reported-by: Christian Borntraeger <borntraeger@linux.ibm.com>
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Ingo Franzki <ifranzki@linux.ibm.com>
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
This commit is contained in:
Holger Dengler 2026-06-15 17:39:12 +02:00 committed by Alexander Gordeev
parent 6938846872
commit b3d4ab2d7d
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/s390/crypto/pkey_api.c
View File

@ -334,6 +334,13 @@ static int pkey_ioctl_verifyprotk(struct pkey_verifyprotk __user *uvp)
if (copy_from_user(&kvp, uvp, sizeof(kvp)))
return -EFAULT;
if (kvp.protkey.len > sizeof(kvp.protkey.protkey)) {
PKEY_DBF_ERR("%s protkey length %u exceeds protkey buffer size\n",
__func__, kvp.protkey.len);
memzero_explicit(&kvp, sizeof(kvp));
return -EINVAL;
}
keytype = pkey_aes_bitsize_to_keytype(8 * kvp.protkey.len);
if (!keytype) {
PKEY_DBF_ERR("%s unknown/unsupported protkey length %u\n",