Skip to content

Commit 295e138

Browse files
committed
Merge tag 's390-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux
Pull s390 fixes from Heiko Carstens: - Fix per vma lock fault handling: add missing !(fault & VM_FAULT_ERROR) check to fault handler to prevent error handling for return values that don't indicate an error - Use kfree_sensitive() instead of kfree() in paes crypto code to clear memory that may contain keys before freeing it - Fix reply buffer size calculation for CCA replies in zcrypt device driver * tag 's390-6.5-3' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: s390/zcrypt: fix reply buffer calculations for CCA replies s390/crypto: use kfree_sensitive() instead of kfree() s390/mm: fix per vma lock fault handling
2 parents f036d67 + 4cfca53 commit 295e138

File tree

3 files changed

+27
-12
lines changed

3 files changed

+27
-12
lines changed

arch/s390/crypto/paes_s390.c

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -103,7 +103,7 @@ static inline void _free_kb_keybuf(struct key_blob *kb)
103103
{
104104
if (kb->key && kb->key != kb->keybuf
105105
&& kb->keylen > sizeof(kb->keybuf)) {
106-
kfree(kb->key);
106+
kfree_sensitive(kb->key);
107107
kb->key = NULL;
108108
}
109109
}

arch/s390/mm/fault.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -421,6 +421,8 @@ static inline vm_fault_t do_exception(struct pt_regs *regs, int access)
421421
vma_end_read(vma);
422422
if (!(fault & VM_FAULT_RETRY)) {
423423
count_vm_vma_lock_event(VMA_LOCK_SUCCESS);
424+
if (likely(!(fault & VM_FAULT_ERROR)))
425+
fault = 0;
424426
goto out;
425427
}
426428
count_vm_vma_lock_event(VMA_LOCK_RETRY);

drivers/s390/crypto/zcrypt_msgtype6.c

Lines changed: 24 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -1101,23 +1101,36 @@ static long zcrypt_msgtype6_send_cprb(bool userspace, struct zcrypt_queue *zq,
11011101
struct ica_xcRB *xcrb,
11021102
struct ap_message *ap_msg)
11031103
{
1104-
int rc;
11051104
struct response_type *rtype = ap_msg->private;
11061105
struct {
11071106
struct type6_hdr hdr;
11081107
struct CPRBX cprbx;
11091108
/* ... more data blocks ... */
11101109
} __packed * msg = ap_msg->msg;
1111-
1112-
/*
1113-
* Set the queue's reply buffer length minus 128 byte padding
1114-
* as reply limit for the card firmware.
1115-
*/
1116-
msg->hdr.fromcardlen1 = min_t(unsigned int, msg->hdr.fromcardlen1,
1117-
zq->reply.bufsize - 128);
1118-
if (msg->hdr.fromcardlen2)
1119-
msg->hdr.fromcardlen2 =
1120-
zq->reply.bufsize - msg->hdr.fromcardlen1 - 128;
1110+
unsigned int max_payload_size;
1111+
int rc, delta;
1112+
1113+
/* calculate maximum payload for this card and msg type */
1114+
max_payload_size = zq->reply.bufsize - sizeof(struct type86_fmt2_msg);
1115+
1116+
/* limit each of the two from fields to the maximum payload size */
1117+
msg->hdr.fromcardlen1 = min(msg->hdr.fromcardlen1, max_payload_size);
1118+
msg->hdr.fromcardlen2 = min(msg->hdr.fromcardlen2, max_payload_size);
1119+
1120+
/* calculate delta if the sum of both exceeds max payload size */
1121+
delta = msg->hdr.fromcardlen1 + msg->hdr.fromcardlen2
1122+
- max_payload_size;
1123+
if (delta > 0) {
1124+
/*
1125+
* Sum exceeds maximum payload size, prune fromcardlen1
1126+
* (always trust fromcardlen2)
1127+
*/
1128+
if (delta > msg->hdr.fromcardlen1) {
1129+
rc = -EINVAL;
1130+
goto out;
1131+
}
1132+
msg->hdr.fromcardlen1 -= delta;
1133+
}
11211134

11221135
init_completion(&rtype->work);
11231136
rc = ap_queue_message(zq->queue, ap_msg);

0 commit comments

Comments
 (0)