Commit d834502e authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull key handling update from James Morris:
 "This alters a new keyctl function added in the current merge window to
  allow for a future extension planned for the next merge window"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  KEYS: Add placeholder for KDF usage with DH
parents eedf265a 4693fc73
...@@ -826,7 +826,8 @@ The keyctl syscall functions are: ...@@ -826,7 +826,8 @@ The keyctl syscall functions are:
(*) Compute a Diffie-Hellman shared secret or public key (*) Compute a Diffie-Hellman shared secret or public key
long keyctl(KEYCTL_DH_COMPUTE, struct keyctl_dh_params *params, long keyctl(KEYCTL_DH_COMPUTE, struct keyctl_dh_params *params,
char *buffer, size_t buflen); char *buffer, size_t buflen,
void *reserved);
The params struct contains serial numbers for three keys: The params struct contains serial numbers for three keys:
...@@ -843,6 +844,8 @@ The keyctl syscall functions are: ...@@ -843,6 +844,8 @@ The keyctl syscall functions are:
public key. If the base is the remote public key, the result is public key. If the base is the remote public key, the result is
the shared secret. the shared secret.
The reserved argument must be set to NULL.
The buffer length must be at least the length of the prime, or zero. The buffer length must be at least the length of the prime, or zero.
If the buffer length is nonzero, the length of the result is If the buffer length is nonzero, the length of the result is
......
...@@ -134,7 +134,7 @@ COMPAT_SYSCALL_DEFINE5(keyctl, u32, option, ...@@ -134,7 +134,7 @@ COMPAT_SYSCALL_DEFINE5(keyctl, u32, option,
case KEYCTL_DH_COMPUTE: case KEYCTL_DH_COMPUTE:
return keyctl_dh_compute(compat_ptr(arg2), compat_ptr(arg3), return keyctl_dh_compute(compat_ptr(arg2), compat_ptr(arg3),
arg4); arg4, compat_ptr(arg5));
default: default:
return -EOPNOTSUPP; return -EOPNOTSUPP;
......
...@@ -78,7 +78,8 @@ error: ...@@ -78,7 +78,8 @@ error:
} }
long keyctl_dh_compute(struct keyctl_dh_params __user *params, long keyctl_dh_compute(struct keyctl_dh_params __user *params,
char __user *buffer, size_t buflen) char __user *buffer, size_t buflen,
void __user *reserved)
{ {
long ret; long ret;
MPI base, private, prime, result; MPI base, private, prime, result;
...@@ -97,6 +98,11 @@ long keyctl_dh_compute(struct keyctl_dh_params __user *params, ...@@ -97,6 +98,11 @@ long keyctl_dh_compute(struct keyctl_dh_params __user *params,
goto out; goto out;
} }
if (reserved) {
ret = -EINVAL;
goto out;
}
keylen = mpi_from_key(pcopy.prime, buflen, &prime); keylen = mpi_from_key(pcopy.prime, buflen, &prime);
if (keylen < 0 || !prime) { if (keylen < 0 || !prime) {
/* buflen == 0 may be used to query the required buffer size, /* buflen == 0 may be used to query the required buffer size,
......
...@@ -260,10 +260,11 @@ static inline long keyctl_get_persistent(uid_t uid, key_serial_t destring) ...@@ -260,10 +260,11 @@ static inline long keyctl_get_persistent(uid_t uid, key_serial_t destring)
#ifdef CONFIG_KEY_DH_OPERATIONS #ifdef CONFIG_KEY_DH_OPERATIONS
extern long keyctl_dh_compute(struct keyctl_dh_params __user *, char __user *, extern long keyctl_dh_compute(struct keyctl_dh_params __user *, char __user *,
size_t); size_t, void __user *);
#else #else
static inline long keyctl_dh_compute(struct keyctl_dh_params __user *params, static inline long keyctl_dh_compute(struct keyctl_dh_params __user *params,
char __user *buffer, size_t buflen) char __user *buffer, size_t buflen,
void __user *reserved)
{ {
return -EOPNOTSUPP; return -EOPNOTSUPP;
} }
......
...@@ -1688,8 +1688,8 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3, ...@@ -1688,8 +1688,8 @@ SYSCALL_DEFINE5(keyctl, int, option, unsigned long, arg2, unsigned long, arg3,
case KEYCTL_DH_COMPUTE: case KEYCTL_DH_COMPUTE:
return keyctl_dh_compute((struct keyctl_dh_params __user *) arg2, return keyctl_dh_compute((struct keyctl_dh_params __user *) arg2,
(char __user *) arg3, (char __user *) arg3, (size_t) arg4,
(size_t) arg4); (void __user *) arg5);
default: default:
return -EOPNOTSUPP; return -EOPNOTSUPP;
......
Markdown is supported
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment