Merge tag 'for-next-keys-7.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd

Pull keys update from Jarkko Sakkinen: "This contains only bug fixes" * tag 'for-next-keys-7.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: keys: keyctl_pkey: replace BUG with return -EOPNOTSUPP keys: request_key: replace BUG with return -EINVAL keys: Pin request_key_auth payload in instantiate paths keys: prevent slab cache merging for key_jar keys: Replace strcpy(derived_buf, "AUTH_KEY") with strscpy(..., HASH_SIZE) KEYS: Use acquire when reading state in keyring search keys/trusted_keys: mark 'migratable' as __ro_after_init keys: use kmalloc_flex in user_preparse KEYS: trusted: Debugging as a feature KEYS: encrypted: Remove unnecessary selection of CRYPTO_RNG KEYS: fix overflow in keyctl_pkey_params_get_2()

Linus Torvalds committed 4 months ago

Commit e2c05952 parents 0798268 1b9524217 files · +158 −49Browse files

Unified · Split

17 files

Documentation/admin-guide/kernel-parameters.txt +16 −0
include/keys/request_key_auth-type.h +2 −0
include/keys/trusted-type.h +12 −9
security/keys/Kconfig +0 −1
security/keys/encrypted-keys/encrypted.c +2 −2
security/keys/internal.h +2 −0
security/keys/key.c +1 −1
security/keys/keyctl.c +18 −6
security/keys/keyctl_pkey.c +11 −3
security/keys/keyring.c +1 −1
security/keys/request_key.c +1 −1
security/keys/request_key_auth.c +31 −2
security/keys/trusted-keys/Kconfig +23 −0
security/keys/trusted-keys/trusted_caam.c +5 −2
security/keys/trusted-keys/trusted_core.c +7 −1
security/keys/trusted-keys/trusted_tpm1.c +25 −19
security/keys/user_defined.c +1 −1

Documentation/admin-guide/kernel-parameters.txt+16−0

@@ -7872,6 +7872,22 @@ Kernel parameters · 7871 unmodified lines
7872	7872	first trust source as a backend which is initialized
7873	7873	successfully during iteration.
7874	7874
	7875	+ trusted.debug= [KEYS]
	7876	+ Format: <bool>
	7877	+ Enable trusted keys debug traces at runtime when
	7878	+ CONFIG_TRUSTED_KEYS_DEBUG=y.
	7879	+
	7880	+ To make the traces visible after enabling the option,
	7881	+ use trusted.dyndbg='+p' as needed. By convention,
	7882	+ the subsystem uses pr_debug() for these traces.
	7883	+
	7884	+ SAFETY: The traces can leak sensitive data, so be
	7885	+ cautious before enabling this. They remain inactive
	7886	+ unless this parameter is set this option to a true
	7887	+ value.
	7888	+
	7889	+ Default: false
	7890	+
7875	7891	trusted.rng= [KEYS]
7876	7892	Format: <string>
7877	7893	The RNG used to generate key material for trusted keys.

include/keys/request_key_auth-type.h+2−0

@@ -9,12 +9,14 @@ · 8 unmodified lines
9	9	#define _KEYS_REQUEST_KEY_AUTH_TYPE_H
10	10
11	11	#include <linux/key.h>
	12	+#include <linux/refcount.h>
12	13
13	14	/*
14	15	* Authorisation record for request_key().
15	16	*/
16	17	struct request_key_auth {
17	18	struct rcu_head rcu;
	19	+ refcount_t usage;
18	20	struct key *target_key;
19	21	struct key *dest_keyring;
20	22	const struct cred *cred;

include/keys/trusted-type.h+12−9

@@ -83,18 +83,21 @@ struct trusted_key_source { · 82 unmodified lines
83	83
84	84	extern struct key_type key_type_trusted;
85	85
86		−#define TRUSTED_DEBUG 0
	86	+#ifdef CONFIG_TRUSTED_KEYS_DEBUG
	87	+extern bool trusted_debug;
87	88
88		−#if TRUSTED_DEBUG
89	89	static inline void dump_payload(struct trusted_key_payload *p)
90	90	{
91		− pr_info("key_len %d\n", p->key_len);
92		− print_hex_dump(KERN_INFO, "key ", DUMP_PREFIX_NONE,
93		− 16, 1, p->key, p->key_len, 0);
94		− pr_info("bloblen %d\n", p->blob_len);
95		− print_hex_dump(KERN_INFO, "blob ", DUMP_PREFIX_NONE,
96		− 16, 1, p->blob, p->blob_len, 0);
97		− pr_info("migratable %d\n", p->migratable);
	91	+ if (!trusted_debug)
	92	+ return;
	93	+
	94	+ pr_debug("key_len %d\n", p->key_len);
	95	+ print_hex_dump_debug("key ", DUMP_PREFIX_NONE,
	96	+ 16, 1, p->key, p->key_len, 0);
	97	+ pr_debug("bloblen %d\n", p->blob_len);
	98	+ print_hex_dump_debug("blob ", DUMP_PREFIX_NONE,
	99	+ 16, 1, p->blob, p->blob_len, 0);
	100	+ pr_debug("migratable %d\n", p->migratable);
98	101	}
99	102	#else
100	103	static inline void dump_payload(struct trusted_key_payload *p)

security/keys/Kconfig+0−1

@@ -87,7 +87,6 @@ config ENCRYPTED_KEYS · 86 unmodified lines
87	87	select CRYPTO_AES
88	88	select CRYPTO_CBC
89	89	select CRYPTO_LIB_SHA256
90		− select CRYPTO_RNG
91	90	help
92	91	This option provides support for create/encrypting/decrypting keys
93	92	in the kernel. Encrypted keys are instantiated using kernel

security/keys/encrypted-keys/encrypted.c+2−2

@@ -343,9 +343,9 @@ static int get_derived_key(u8 *derived_key, enum derived_key_type key_type, · 342 unmodified lines
343	343	return -ENOMEM;
344	344
345	345	if (key_type)
346		− strcpy(derived_buf, "AUTH_KEY");
	346	+ strscpy(derived_buf, "AUTH_KEY", HASH_SIZE);
347	347	else
348		− strcpy(derived_buf, "ENC_KEY");
	348	+ strscpy(derived_buf, "ENC_KEY", HASH_SIZE);
349	349
350	350	memcpy(derived_buf + strlen(derived_buf) + 1, master_key,
351	351	master_keylen);

security/keys/internal.h+2−0

@@ -208,6 +208,8 @@ extern struct key request_key_auth_new(struct key target, · 207 unmodified lines
208	208	const void *callout_info,
209	209	size_t callout_len,
210	210	struct key *dest_keyring);
	211	+struct request_key_auth request_key_auth_get(struct key authkey);
	212	+void request_key_auth_put(struct request_key_auth *rka);
211	213
212	214	extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
213	215

security/keys/key.c+1−1

@@ -1275,7 +1275,7 @@ void __init key_init(void) · 1274 unmodified lines
1275	1275	{
1276	1276	/* allocate a slab in which we can store keys */
1277	1277	key_jar = kmem_cache_create("key_jar", sizeof(struct key),
1278		− 0, SLAB_HWCACHE_ALIGN\|SLAB_PANIC, NULL);
	1278	+ 0, SLAB_HWCACHE_ALIGN \| SLAB_PANIC \| SLAB_NO_MERGE, NULL);
1279	1279
1280	1280	/* add the special key types */
1281	1281	list_add_tail(&key_type_keyring.link, &key_types_list);

security/keys/keyctl.c+18−6

@@ -1197,9 +1197,13 @@ static long keyctl_instantiate_key_common(key_serial_t id, · 1196 unmodified lines
1197	1197	if (!instkey)
1198	1198	goto error;
1199	1199
1200		− rka = instkey->payload.data[0];
1201		− if (rka->target_key->serial != id)
	1200	+ rka = request_key_auth_get(instkey);
	1201	+ if (!rka) {
	1202	+ ret = -EKEYREVOKED;
1202	1203	goto error;
	1204	+ }
	1205	+ if (rka->target_key->serial != id)
	1206	+ goto error_put_rka;
1203	1207
1204	1208	/* pull the payload in if one was supplied */
1205	1209	payload = NULL;
@@ -1208,7 +1212,7 @@ static long keyctl_instantiate_key_common(key_serial_t id, · 2 unmodified lines
1208	1212	ret = -ENOMEM;
1209	1213	payload = kvmalloc(plen, GFP_KERNEL);
1210	1214	if (!payload)
1211		− goto error;
	1215	+ goto error_put_rka;
1212	1216
1213	1217	ret = -EFAULT;
1214	1218	if (!copy_from_iter_full(payload, plen, from))
@@ -1234,6 +1238,8 @@ static long keyctl_instantiate_key_common(key_serial_t id, · 19 unmodified lines
1234	1238
1235	1239	error2:
1236	1240	kvfree_sensitive(payload, plen);
	1241	+error_put_rka:
	1242	+ request_key_auth_put(rka);
1237	1243	error:
1238	1244	return ret;
1239	1245	}
@@ -1358,15 +1364,19 @@ long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error, · 118 unmodified lines
1358	1364	if (!instkey)
1359	1365	goto error;
1360	1366
1361		− rka = instkey->payload.data[0];
1362		− if (rka->target_key->serial != id)
	1367	+ rka = request_key_auth_get(instkey);
	1368	+ if (!rka) {
	1369	+ ret = -EKEYREVOKED;
1363	1370	goto error;
	1371	+ }
	1372	+ if (rka->target_key->serial != id)
	1373	+ goto error_put_rka;
1364	1374
1365	1375	/* find the destination keyring if present (which must also be
1366	1376	* writable) */
1367	1377	ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
1368	1378	if (ret < 0)
1369		− goto error;
	1379	+ goto error_put_rka;
1370	1380
1371	1381	/* instantiate the key and link it into a keyring */
1372	1382	ret = key_reject_and_link(rka->target_key, timeout, error,
@@ -1379,6 +1389,8 @@ long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error, · 6 unmodified lines
1379	1389	if (ret == 0)
1380	1390	keyctl_change_reqkey_auth(NULL);
1381	1391
	1392	+error_put_rka:
	1393	+ request_key_auth_put(rka);
1382	1394	error:
1383	1395	return ret;
1384	1396	}

security/keys/keyctl_pkey.c+11−3

@@ -138,28 +138,35 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par · 137 unmodified lines
138	138	if (uparams.in_len > info.max_dec_size \|\|
139	139	uparams.out_len > info.max_enc_size)
140	140	return -EINVAL;
	141	+
	142	+ params->out_len = info.max_enc_size;
141	143	break;
142	144	case KEYCTL_PKEY_DECRYPT:
143	145	if (uparams.in_len > info.max_enc_size \|\|
144	146	uparams.out_len > info.max_dec_size)
145	147	return -EINVAL;
	148	+
	149	+ params->out_len = info.max_dec_size;
146	150	break;
147	151	case KEYCTL_PKEY_SIGN:
148	152	if (uparams.in_len > info.max_data_size \|\|
149	153	uparams.out_len > info.max_sig_size)
150	154	return -EINVAL;
	155	+
	156	+ params->out_len = info.max_sig_size;
151	157	break;
152	158	case KEYCTL_PKEY_VERIFY:
153	159	if (uparams.in_len > info.max_data_size \|\|
154	160	uparams.in2_len > info.max_sig_size)
155	161	return -EINVAL;
	162	+
	163	+ params->out_len = info.max_sig_size;
156	164	break;
157	165	default:
158		− BUG();
	166	+ return -EOPNOTSUPP;
159	167	}
160	168
161	169	params->in_len = uparams.in_len;
162		− params->out_len = uparams.out_len; /* Note: same as in2_len */
163	170	return 0;
164	171	}
165	172
@@ -238,7 +245,8 @@ long keyctl_pkey_e_d_s(int op, · 72 unmodified lines
238	245	params.op = kernel_pkey_sign;
239	246	break;
240	247	default:
241		− BUG();
	248	+ ret = -EOPNOTSUPP;
	249	+ goto error_params;
242	250	}
243	251
244	252	in = memdup_user(_in, params.in_len);

security/keys/keyring.c+1−1

@@ -576,7 +576,7 @@ static int keyring_search_iterator(const void object, void iterator_data) · 575 unmodified lines
576	576	struct keyring_search_context *ctx = iterator_data;
577	577	const struct key *key = keyring_ptr_to_key(object);
578	578	unsigned long kflags = READ_ONCE(key->flags);
579		− short state = READ_ONCE(key->state);
	579	+ short state = key_read_state(key);
580	580
581	581	kenter("{%d}", key->serial);
582	582

security/keys/request_key.c+1−1

@@ -332,7 +332,7 @@ static int construct_get_dest_keyring(struct key **_dest_keyring) · 331 unmodified lines
332	332
333	333	case KEY_REQKEY_DEFL_GROUP_KEYRING:
334	334	default:
335		− BUG();
	335	+ return -EINVAL;
336	336	}
337	337
338	338	/*

security/keys/request_key_auth.c+31−2

@@ -23,6 +23,7 @@ static void request_key_auth_describe(const struct key , struct seq_file ); · 22 unmodified lines
23	23	static void request_key_auth_revoke(struct key *);
24	24	static void request_key_auth_destroy(struct key *);
25	25	static long request_key_auth_read(const struct key , char , size_t);
	26	+static void request_key_auth_rcu_disposal(struct rcu_head *);
26	27
27	28	/*
28	29	* The request-key authorisation key type definition.
@@ -115,6 +116,31 @@ static void free_request_key_auth(struct request_key_auth *rka) · 86 unmodified lines
115	116	kfree(rka);
116	117	}
117	118
	119	+/*
	120	+ * Take a reference to the request-key authorisation payload so callers can
	121	+ * drop authkey->sem before doing operations that may sleep.
	122	+ */
	123	+struct request_key_auth request_key_auth_get(struct key authkey)
	124	+{
	125	+ struct request_key_auth *rka;
	126	+
	127	+ down_read(&authkey->sem);
	128	+ rka = dereference_key_locked(authkey);
	129	+ if (rka && !test_bit(KEY_FLAG_REVOKED, &authkey->flags))
	130	+ refcount_inc(&rka->usage);
	131	+ else
	132	+ rka = NULL;
	133	+ up_read(&authkey->sem);
	134	+
	135	+ return rka;
	136	+}
	137	+
	138	+void request_key_auth_put(struct request_key_auth *rka)
	139	+{
	140	+ if (rka && refcount_dec_and_test(&rka->usage))
	141	+ call_rcu(&rka->rcu, request_key_auth_rcu_disposal);
	142	+}
	143	+
118	144	/*
119	145	* Dispose of the request_key_auth record under RCU conditions
120	146	*/
@@ -136,8 +162,10 @@ static void request_key_auth_revoke(struct key *key) · 15 unmodified lines
136	162	struct request_key_auth *rka = dereference_key_locked(key);
137	163
138	164	kenter("{%d}", key->serial);
	165	+ if (!rka)
	166	+ return;
139	167	rcu_assign_keypointer(key, NULL);
140		− call_rcu(&rka->rcu, request_key_auth_rcu_disposal);
	168	+ request_key_auth_put(rka);
141	169	}
142	170
143	171	/*
@@ -150,7 +178,7 @@ static void request_key_auth_destroy(struct key *key) · 6 unmodified lines
150	178	kenter("{%d}", key->serial);
151	179	if (rka) {
152	180	rcu_assign_keypointer(key, NULL);
153		− call_rcu(&rka->rcu, request_key_auth_rcu_disposal);
	181	+ request_key_auth_put(rka);
154	182	}
155	183	}
156	184
@@ -174,6 +202,7 @@ struct key request_key_auth_new(struct key target, const char *op, · 17 unmodified lines
174	202	rka = kzalloc_obj(*rka);
175	203	if (!rka)
176	204	goto error;
	205	+ refcount_set(&rka->usage, 1);
177	206	rka->callout_info = kmemdup(callout_info, callout_len, GFP_KERNEL);
178	207	if (!rka->callout_info)
179	208	goto error_free_rka;

security/keys/trusted-keys/Kconfig+23−0

@@ -1,10 +1,29 @@
1	1	config HAVE_TRUSTED_KEYS
2	2	bool
3	3
	4	+config HAVE_TRUSTED_KEYS_DEBUG
	5	+ bool
	6	+
	7	+config TRUSTED_KEYS_DEBUG
	8	+ bool "Debug trusted keys"
	9	+ depends on HAVE_TRUSTED_KEYS_DEBUG
	10	+ default n
	11	+ help
	12	+ Trusted key backends and core code that support debug traces can
	13	+ opt-in that feature here. Traces must only use debug level output, as
	14	+ sensitive data may pass by. In the kernel-command line traces can be
	15	+ enabled via trusted.dyndbg='+p'.
	16	+
	17	+ SAFETY: Debug dumps are inactive at runtime until trusted.debug is set
	18	+ to a true value on the kernel command-line. Use at your utmost
	19	+ consideration when enabling this feature on a production build. The
	20	+ general advice is not to do this.
	21	+
4	22	config TRUSTED_KEYS_TPM
5	23	bool "TPM-based trusted keys"
6	24	depends on TCG_TPM >= TRUSTED_KEYS
7	25	default y
	26	+ select HAVE_TRUSTED_KEYS_DEBUG
8	27	select CRYPTO_HASH_INFO
9	28	select CRYPTO_LIB_SHA1
10	29	select CRYPTO_LIB_UTILS
@@ -23,6 +42,7 @@ config TRUSTED_KEYS_TEE · 12 unmodified lines
23	42	bool "TEE-based trusted keys"
24	43	depends on TEE >= TRUSTED_KEYS
25	44	default y
	45	+ select HAVE_TRUSTED_KEYS_DEBUG
26	46	select HAVE_TRUSTED_KEYS
27	47	help
28	48	Enable use of the Trusted Execution Environment (TEE) as trusted
@@ -33,6 +53,7 @@ config TRUSTED_KEYS_CAAM · 4 unmodified lines
33	53	depends on CRYPTO_DEV_FSL_CAAM_JR >= TRUSTED_KEYS
34	54	select CRYPTO_DEV_FSL_CAAM_BLOB_GEN
35	55	default y
	56	+ select HAVE_TRUSTED_KEYS_DEBUG
36	57	select HAVE_TRUSTED_KEYS
37	58	help
38	59	Enable use of NXP's Cryptographic Accelerator and Assurance Module
@@ -42,6 +63,7 @@ config TRUSTED_KEYS_DCP · 3 unmodified lines
42	63	bool "DCP-based trusted keys"
43	64	depends on CRYPTO_DEV_MXS_DCP >= TRUSTED_KEYS
44	65	default y
	66	+ select HAVE_TRUSTED_KEYS_DEBUG
45	67	select HAVE_TRUSTED_KEYS
46	68	help
47	69	Enable use of NXP's DCP (Data Co-Processor) as trusted key backend.
@@ -50,6 +72,7 @@ config TRUSTED_KEYS_PKWM · 2 unmodified lines
50	72	bool "PKWM-based trusted keys"
51	73	depends on PSERIES_PLPKS >= TRUSTED_KEYS
52	74	default y
	75	+ select HAVE_TRUSTED_KEYS_DEBUG
53	76	select HAVE_TRUSTED_KEYS
54	77	help
55	78	Enable use of IBM PowerVM Key Wrapping Module (PKWM) as a trusted key backend.

security/keys/trusted-keys/trusted_caam.c+5−2

@@ -28,10 +28,13 @@ static const match_table_t key_tokens = { · 27 unmodified lines
28	28	{opt_err, NULL}
29	29	};
30	30
31		−#ifdef CAAM_DEBUG
	31	+#ifdef CONFIG_TRUSTED_KEYS_DEBUG
32	32	static inline void dump_options(const struct caam_pkey_info *pkey_info)
33	33	{
34		− pr_info("key encryption algo %d\n", pkey_info->key_enc_algo);
	34	+ if (!trusted_debug)
	35	+ return;
	36	+
	37	+ pr_debug("key encryption algo %d\n", pkey_info->key_enc_algo);
35	38	}
36	39	#else
37	40	static inline void dump_options(const struct caam_pkey_info *pkey_info)

security/keys/trusted-keys/trusted_core.c+7−1

@@ -31,6 +31,12 @@ static char *trusted_rng = "default"; · 30 unmodified lines
31	31	module_param_named(rng, trusted_rng, charp, 0);
32	32	MODULE_PARM_DESC(rng, "Select trusted key RNG");
33	33
	34	+#ifdef CONFIG_TRUSTED_KEYS_DEBUG
	35	+bool trusted_debug;
	36	+module_param_named(debug, trusted_debug, bool, 0);
	37	+MODULE_PARM_DESC(debug, "Enable trusted keys debug traces (default: 0)");
	38	+#endif
	39	+
34	40	static char *trusted_key_source;
35	41	module_param_named(source, trusted_key_source, charp, 0);
36	42	MODULE_PARM_DESC(source, "Select trusted keys source (tpm, tee, caam, dcp or pkwm)");
@@ -59,7 +65,7 @@ DEFINE_STATIC_CALL_NULL(trusted_key_unseal, · 22 unmodified lines
59	65	DEFINE_STATIC_CALL_NULL(trusted_key_get_random,
60	66	*trusted_key_sources[0].ops->get_random);
61	67	static void (*trusted_key_exit)(void);
62		−static unsigned char migratable;
	68	+static unsigned char migratable __ro_after_init;
63	69
64	70	enum {
65	71	Opt_err,

security/keys/trusted-keys/trusted_tpm1.c+25−19

@@ -46,38 +46,44 @@ enum { · 45 unmodified lines
46	46	SRK_keytype = 4
47	47	};
48	48
49		−#define TPM_DEBUG 0
50		−
51		−#if TPM_DEBUG
	49	+#ifdef CONFIG_TRUSTED_KEYS_DEBUG
52	50	static inline void dump_options(struct trusted_key_options *o)
53	51	{
54		− pr_info("sealing key type %d\n", o->keytype);
55		− pr_info("sealing key handle %0X\n", o->keyhandle);
56		− pr_info("pcrlock %d\n", o->pcrlock);
57		− pr_info("pcrinfo %d\n", o->pcrinfo_len);
58		− print_hex_dump(KERN_INFO, "pcrinfo ", DUMP_PREFIX_NONE,
59		− 16, 1, o->pcrinfo, o->pcrinfo_len, 0);
	52	+ if (!trusted_debug)
	53	+ return;
	54	+
	55	+ pr_debug("sealing key type %d\n", o->keytype);
	56	+ pr_debug("sealing key handle %0X\n", o->keyhandle);
	57	+ pr_debug("pcrlock %d\n", o->pcrlock);
	58	+ pr_debug("pcrinfo %d\n", o->pcrinfo_len);
	59	+ print_hex_dump_debug("pcrinfo ", DUMP_PREFIX_NONE,
	60	+ 16, 1, o->pcrinfo, o->pcrinfo_len, 0);
60	61	}
61	62
62	63	static inline void dump_sess(struct osapsess *s)
63	64	{
64		− print_hex_dump(KERN_INFO, "trusted-key: handle ", DUMP_PREFIX_NONE,
65		− 16, 1, &s->handle, 4, 0);
66		− pr_info("secret:\n");
67		− print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE,
68		− 16, 1, &s->secret, SHA1_DIGEST_SIZE, 0);
69		− pr_info("trusted-key: enonce:\n");
70		− print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE,
71		− 16, 1, &s->enonce, SHA1_DIGEST_SIZE, 0);
	65	+ if (!trusted_debug)
	66	+ return;
	67	+
	68	+ print_hex_dump_debug("trusted-key: handle ", DUMP_PREFIX_NONE,
	69	+ 16, 1, &s->handle, 4, 0);
	70	+ pr_debug("secret:\n");
	71	+ print_hex_dump_debug("", DUMP_PREFIX_NONE,
	72	+ 16, 1, &s->secret, SHA1_DIGEST_SIZE, 0);
	73	+ pr_debug("trusted-key: enonce:\n");
	74	+ print_hex_dump_debug("", DUMP_PREFIX_NONE,
	75	+ 16, 1, &s->enonce, SHA1_DIGEST_SIZE, 0);
72	76	}
73	77
74	78	static inline void dump_tpm_buf(unsigned char *buf)
75	79	{
76	80	int len;
77	81
78		− pr_info("\ntpm buffer\n");
	82	+ if (!trusted_debug)
	83	+ return;
	84	+ pr_debug("\ntpm buffer\n");
79	85	len = LOAD32(buf, TPM_SIZE_OFFSET);
80		− print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, 16, 1, buf, len, 0);
	86	+ print_hex_dump_debug("", DUMP_PREFIX_NONE, 16, 1, buf, len, 0);
81	87	}
82	88	#else
83	89	static inline void dump_options(struct trusted_key_options *o)

security/keys/user_defined.c+1−1

@@ -64,7 +64,7 @@ int user_preparse(struct key_preparsed_payload *prep) · 63 unmodified lines
64	64	if (datalen == 0 \|\| datalen > 32767 \|\| !prep->data)
65	65	return -EINVAL;
66	66
67		− upayload = kmalloc(sizeof(*upayload) + datalen, GFP_KERNEL);
	67	+ upayload = kmalloc_flex(*upayload, data, datalen);
68	68	if (!upayload)
69	69	return -ENOMEM;
70	70