]> git.proxmox.com Git - mirror_ubuntu-jammy-kernel.git/commit
KEYS: fix length validation in keyctl_pkey_params_get_2()
authorEric Biggers <ebiggers@google.com>
Thu, 13 Jan 2022 20:04:54 +0000 (12:04 -0800)
committerStefan Bader <stefan.bader@canonical.com>
Wed, 27 Apr 2022 09:56:27 +0000 (11:56 +0200)
commit66dbec71493580b7b7c5ce6cdafa8884272585a6
tree0d5771b3e55efab09448e4a3ab85276755128e28
parentaf7482933977480d941c5841634826a4264fd74f
KEYS: fix length validation in keyctl_pkey_params_get_2()

BugLink: https://bugs.launchpad.net/bugs/1969110
commit c51abd96837f600d8fd940b6ab8e2da578575504 upstream.

In many cases, keyctl_pkey_params_get_2() is validating the user buffer
lengths against the wrong algorithm properties.  Fix it to check against
the correct properties.

Probably this wasn't noticed before because for all asymmetric keys of
the "public_key" subtype, max_data_size == max_sig_size == max_enc_size
== max_dec_size.  However, this isn't necessarily true for the
"asym_tpm" subtype (it should be, but it's not strictly validated).  Of
course, future key types could have different values as well.

Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]")
Cc: <stable@vger.kernel.org> # v4.20+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit fe8df44892407e301ed03027639b4d904f12694c)
Signed-off-by: Paolo Pisati <paolo.pisati@canonical.com>
security/keys/keyctl_pkey.c