2
0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2025-09-04 20:19:47 +08:00
linux/drivers/s390/crypto
Fedor Pchelkin 7360ee4759 s390/pkey: Prevent overflow in size calculation for memdup_user()
Number of apqn target list entries contained in 'nr_apqns' variable is
determined by userspace via an ioctl call so the result of the product in
calculation of size passed to memdup_user() may overflow.

In this case the actual size of the allocated area and the value
describing it won't be in sync leading to various types of unpredictable
behaviour later.

Use a proper memdup_array_user() helper which returns an error if an
overflow is detected. Note that it is different from when nr_apqns is
initially zero - that case is considered valid and should be handled in
subsequent pkey_handler implementations.

Found by Linux Verification Center (linuxtesting.org).

Fixes: f2bbc96e7c ("s390/pkey: add CCA AES cipher key support")
Cc: stable@vger.kernel.org
Signed-off-by: Fedor Pchelkin <pchelkin@ispras.ru>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Reviewed-by: Heiko Carstens <hca@linux.ibm.com>
Link: https://lore.kernel.org/r/20250611192011.206057-1-pchelkin@ispras.ru
Signed-off-by: Alexander Gordeev <agordeev@linux.ibm.com>
2025-06-16 16:15:24 +02:00
..
ap_bus.c treewide, timers: Rename from_timer() to timer_container_of() 2025-06-08 09:07:37 +02:00
ap_bus.h s390/ap/zcrypt: New xflag parameter 2025-04-30 11:34:00 +02:00
ap_card.c s390/ap: store TAPQ hwinfo in struct ap_card 2023-11-30 16:24:23 +01:00
ap_debug.h s390/zcrypt: introduce dynamic debugging for AP and zcrypt code 2024-02-16 14:30:12 +01:00
ap_queue.c treewide: Switch/rename to timer_delete[_sync]() 2025-04-05 10:30:12 +02:00
Makefile s390/pkey: Add new pkey handler module pkey-uv 2024-10-29 11:17:18 +01:00
pkey_api.c s390/pkey: Prevent overflow in size calculation for memdup_user() 2025-06-16 16:15:24 +02:00
pkey_base.c s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
pkey_base.h s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
pkey_cca.c s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
pkey_ep11.c s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
pkey_pckmo.c s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
pkey_sysfs.c s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
pkey_uv.c s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
vfio_ap_debug.h s390-vfio-ap: introduces s390 kernel debug feature for vfio_ap device driver 2022-02-06 23:31:29 +01:00
vfio_ap_drv.c s390/vfio-ap: Driver feature advertisement 2024-09-23 17:57:04 +02:00
vfio_ap_ops.c s390/vfio-ap: Fix no AP queue sharing allowed message written to kernel log 2025-04-01 16:24:22 +02:00
vfio_ap_private.h s390/vfio-ap: Signal eventfd when guest AP configuration is changed 2025-02-18 18:53:48 +01:00
zcrypt_api.c s390/zcrypt: Rework zcrypt function zcrypt_device_status_mask_ext 2025-04-30 11:34:01 +02:00
zcrypt_api.h s390/zcrypt: Rework zcrypt function zcrypt_device_status_mask_ext 2025-04-30 11:34:01 +02:00
zcrypt_card.c s390/zcrypt: don't report online if card or queue is in check-stop state 2023-11-05 22:34:57 +01:00
zcrypt_cca_key.h s390/zcrypt: rework arrays with length zero occurrences 2023-04-19 16:47:31 +02:00
zcrypt_ccamisc.c s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
zcrypt_ccamisc.h s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
zcrypt_cex2a.c s390/zcrypt: remove CEX2 and CEX3 device drivers 2023-07-24 12:12:22 +02:00
zcrypt_cex2a.h s390/zcrypt: remove CEX2 and CEX3 device drivers 2023-07-24 12:12:22 +02:00
zcrypt_cex2c.c s390/zcrypt: remove CEX2 and CEX3 device drivers 2023-07-24 12:12:22 +02:00
zcrypt_cex2c.h s390/zcrypt: remove CEX2 and CEX3 device drivers 2023-07-24 12:12:22 +02:00
zcrypt_cex4.c s390/zcrypt: Rework ep11 misc functions to use cprb mempool 2025-04-30 11:34:02 +02:00
zcrypt_cex4.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
zcrypt_debug.h s390/zcrypt: introduce dynamic debugging for AP and zcrypt code 2024-02-16 14:30:12 +01:00
zcrypt_ep11misc.c s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
zcrypt_ep11misc.h s390/pkey: Provide and pass xflags within pkey and zcrypt layers 2025-04-30 11:34:03 +02:00
zcrypt_error.h s390/zcrypt: improve zcrypt retry behavior 2024-03-07 14:41:15 +01:00
zcrypt_msgtype6.c s390/ap/zcrypt: Rework AP message buffer allocation 2025-04-30 11:34:00 +02:00
zcrypt_msgtype6.h s390/zcrypt: code cleanup 2022-04-25 13:54:14 +02:00
zcrypt_msgtype50.c s390/ap/zcrypt: Rework AP message buffer allocation 2025-04-30 11:34:00 +02:00
zcrypt_msgtype50.h s390/zcrypt: remove CEX2 and CEX3 device drivers 2023-07-24 12:12:22 +02:00
zcrypt_queue.c s390/zcrypt: don't report online if card or queue is in check-stop state 2023-11-05 22:34:57 +01:00