Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4f9dabfa authored Jul 13, 2017 by Eric Biggers Committed by James Morris Jul 14, 2017

KEYS: DH: validate __spare field



Syscalls must validate that their reserved arguments are zero and return
EINVAL otherwise.  Otherwise, it will be impossible to actually use them
for anything in the future because existing programs may be passing
garbage in.  This is standard practice when adding new APIs.

Cc: stable@vger.kernel.org
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

parent 5ccbdbf9

security/keys/compat_dh.c

+2 −0

Original line number	Diff line number	Diff line
		@@ -33,6 +33,8 @@ long compat_keyctl_dh_compute(struct keyctl_dh_params __user *params,
		kdfcopy.hashname = compat_ptr(compat_kdfcopy.hashname);
		kdfcopy.otherinfo = compat_ptr(compat_kdfcopy.otherinfo);
		kdfcopy.otherinfolen = compat_kdfcopy.otherinfolen;
		memcpy(kdfcopy.__spare, compat_kdfcopy.__spare,
		sizeof(kdfcopy.__spare));

		return __keyctl_dh_compute(params, buffer, buflen, &kdfcopy);
		}

security/keys/dh.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -266,6 +266,11 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
		if (kdfcopy) {
		char *hashname;

		if (memchr_inv(kdfcopy->__spare, 0, sizeof(kdfcopy->__spare))) {
		ret = -EINVAL;
		goto out1;
		}

		if (buflen > KEYCTL_KDF_MAX_OUTPUT_LEN \|\|
		kdfcopy->otherinfolen > KEYCTL_KDF_MAX_OI_LEN) {
		ret = -EMSGSIZE;