Commit f43b1569 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'keys-next-6.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd 

Pull keys fixes from Jarkko Sakkinen:
 "A couple of fixes for keys and trusted keys"

* tag 'keys-next-6.12-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  KEYS: trusted: dcp: fix NULL dereference in AEAD crypto operation
  security/keys: fix slab-out-of-bounds in key_task_permission
parents 7758b206 04de7589

security/keys/keyring.c

+5 −2
Original line number Diff line number Diff line
@@ -772,8 +772,11 @@ static bool search_nested_keyrings(struct key *keyring, 
	for (; slot < ASSOC_ARRAY_FAN_OUT; slot++) {

		ptr = READ_ONCE(node->slots[slot]);



		if (assoc_array_ptr_is_meta(ptr) && node->back_pointer)

		if (assoc_array_ptr_is_meta(ptr)) {

			if (node->back_pointer ||

			    assoc_array_ptr_is_shortcut(ptr))

				goto descend_to_node;

		}



		if (!keyring_ptr_is_keyring(ptr))

			continue;

security/keys/trusted-keys/trusted_dcp.c

+5 −4
Original line number Diff line number Diff line
@@ -133,6 +133,7 @@ static int do_aead_crypto(u8 *in, u8 *out, size_t len, u8 *key, u8 *nonce, 
	struct scatterlist src_sg, dst_sg;

	struct crypto_aead *aead;

	int ret;

	DECLARE_CRYPTO_WAIT(wait);



	aead = crypto_alloc_aead("gcm(aes)", 0, CRYPTO_ALG_ASYNC);

	if (IS_ERR(aead)) {
@@ -163,8 +164,8 @@ static int do_aead_crypto(u8 *in, u8 *out, size_t len, u8 *key, u8 *nonce, 
	}



	aead_request_set_crypt(aead_req, &src_sg, &dst_sg, len, nonce);

	aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_SLEEP, NULL,

				  NULL);

	aead_request_set_callback(aead_req, CRYPTO_TFM_REQ_MAY_SLEEP,

				  crypto_req_done, &wait);

	aead_request_set_ad(aead_req, 0);



	if (crypto_aead_setkey(aead, key, AES_KEYSIZE_128)) {
@@ -174,9 +175,9 @@ static int do_aead_crypto(u8 *in, u8 *out, size_t len, u8 *key, u8 *nonce, 
	}



	if (do_encrypt)

		ret = crypto_aead_encrypt(aead_req);

		ret = crypto_wait_req(crypto_aead_encrypt(aead_req), &wait);

	else

		ret = crypto_aead_decrypt(aead_req);

		ret = crypto_wait_req(crypto_aead_decrypt(aead_req), &wait);



free_req:

	aead_request_free(aead_req);