Commit 9cb2bf59 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'keys-next-6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd 

Pull keys updates from Jarkko Sakkinen.

Avoid using stack addresses for sg lists. And a cleanup.

* tag 'keys-next-6.14-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  KEYS: trusted: dcp: fix improper sg use with CONFIG_VMAP_STACK=y
  keys: drop shadowing dead prototype
parents 7004a2e4 e8d9fab3

include/keys/system_keyring.h

+1 −1
Original line number Diff line number Diff line
@@ -73,7 +73,6 @@ static inline void __init set_machine_trusted_keys(struct key *keyring) 
}

#endif



extern struct pkcs7_message *pkcs7;

#ifdef CONFIG_SYSTEM_BLACKLIST_KEYRING

extern int mark_hash_blacklisted(const u8 *hash, size_t hash_len,

			       enum blacklist_hash_type hash_type);
@@ -93,6 +92,7 @@ static inline int is_binary_blacklisted(const u8 *hash, size_t hash_len) 
}

#endif



struct pkcs7_message;

#ifdef CONFIG_SYSTEM_REVOCATION_LIST

extern int add_key_to_revocation_list(const char *data, size_t size);

extern int is_key_on_revocation_list(struct pkcs7_message *pkcs7);

security/keys/trusted-keys/trusted_dcp.c

+18 −4
Original line number Diff line number Diff line
@@ -201,12 +201,16 @@ static int trusted_dcp_seal(struct trusted_key_payload *p, char *datablob) 
{

	struct dcp_blob_fmt *b = (struct dcp_blob_fmt *)p->blob;

	int blen, ret;

	u8 plain_blob_key[AES_KEYSIZE_128];

	u8 *plain_blob_key;



	blen = calc_blob_len(p->key_len);

	if (blen > MAX_BLOB_SIZE)

		return -E2BIG;



	plain_blob_key = kmalloc(AES_KEYSIZE_128, GFP_KERNEL);

	if (!plain_blob_key)

		return -ENOMEM;



	b->fmt_version = DCP_BLOB_VERSION;

	get_random_bytes(b->nonce, AES_KEYSIZE_128);

	get_random_bytes(plain_blob_key, AES_KEYSIZE_128);
@@ -229,7 +233,8 @@ static int trusted_dcp_seal(struct trusted_key_payload *p, char *datablob) 
	ret = 0;



out:

	memzero_explicit(plain_blob_key, sizeof(plain_blob_key));

	memzero_explicit(plain_blob_key, AES_KEYSIZE_128);

	kfree(plain_blob_key);



	return ret;

}
@@ -238,7 +243,7 @@ static int trusted_dcp_unseal(struct trusted_key_payload *p, char *datablob) 
{

	struct dcp_blob_fmt *b = (struct dcp_blob_fmt *)p->blob;

	int blen, ret;

	u8 plain_blob_key[AES_KEYSIZE_128];

	u8 *plain_blob_key = NULL;



	if (b->fmt_version != DCP_BLOB_VERSION) {

		pr_err("DCP blob has bad version: %i, expected %i\n",
@@ -256,6 +261,12 @@ static int trusted_dcp_unseal(struct trusted_key_payload *p, char *datablob) 
		goto out;

	}



	plain_blob_key = kmalloc(AES_KEYSIZE_128, GFP_KERNEL);

	if (!plain_blob_key) {

		ret = -ENOMEM;

		goto out;

	}



	ret = decrypt_blob_key(b->blob_key, plain_blob_key);

	if (ret) {

		pr_err("Unable to decrypt blob key: %i\n", ret);
@@ -271,7 +282,10 @@ static int trusted_dcp_unseal(struct trusted_key_payload *p, char *datablob) 


	ret = 0;

out:

	memzero_explicit(plain_blob_key, sizeof(plain_blob_key));

	if (plain_blob_key) {

		memzero_explicit(plain_blob_key, AES_KEYSIZE_128);

		kfree(plain_blob_key);

	}



	return ret;

}