History

Merge tag 'for-next-keys-7.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd

Pull keys update from Jarkko Sakkinen: "This contains only bug fixes" * tag 'for-next-keys-7.2-rc1-2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: keys: keyctl_pkey: replace BUG with return -EOPNOTSUPP keys: request_key: replace BUG with return -EINVAL keys: Pin request_key_auth payload in instantiate paths keys: prevent slab cache merging for key_jar keys: Replace strcpy(derived_buf, "AUTH_KEY") with strscpy(..., HASH_SIZE) KEYS: Use acquire when reading state in keyring search keys/trusted_keys: mark 'migratable' as __ro_after_init keys: use kmalloc_flex in user_preparse KEYS: trusted: Debugging as a feature KEYS: encrypted: Remove unnecessary selection of CRYPTO_RNG KEYS: fix overflow in keyctl_pkey_params_get_2()

Linus Torvalds committed 4 months ago

Commit e2c05952 parents 0798268 1b9524217 files · +158 −49Browse files

Unified · Split

17 files
  1. Documentation/admin-guide/kernel-parameters.txt +16 −0
  2. include/keys/request_key_auth-type.h +2 −0
  3. include/keys/trusted-type.h +12 −9
  4. security/keys/Kconfig +0 −1
  5. security/keys/encrypted-keys/encrypted.c +2 −2
  6. security/keys/internal.h +2 −0
  7. security/keys/key.c +1 −1
  8. security/keys/keyctl.c +18 −6
  9. security/keys/keyctl_pkey.c +11 −3
  10. security/keys/keyring.c +1 −1
  11. security/keys/request_key.c +1 −1
  12. security/keys/request_key_auth.c +31 −2
  13. security/keys/trusted-keys/Kconfig +23 −0
  14. security/keys/trusted-keys/trusted_caam.c +5 −2
  15. security/keys/trusted-keys/trusted_core.c +7 −1
  16. security/keys/trusted-keys/trusted_tpm1.c +25 −19
  17. security/keys/user_defined.c +1 −1
Documentation/admin-guide/kernel-parameters.txt+16−0
@@ -7872,6 +7872,22 @@ Kernel parameters · 7871 unmodified lines
7872 first trust source as a backend which is initialized7872 first trust source as a backend which is initialized
7873 successfully during iteration.7873 successfully during iteration.
7874 7874
7875 trusted.debug= [KEYS]
7876 Format: <bool>
7877 Enable trusted keys debug traces at runtime when
7878 CONFIG_TRUSTED_KEYS_DEBUG=y.
7879
7880 To make the traces visible after enabling the option,
7881 use trusted.dyndbg='+p' as needed. By convention,
7882 the subsystem uses pr_debug() for these traces.
7883
7884 SAFETY: The traces can leak sensitive data, so be
7885 cautious before enabling this. They remain inactive
7886 unless this parameter is set this option to a true
7887 value.
7888
7889 Default: false
7890
7875 trusted.rng= [KEYS]7891 trusted.rng= [KEYS]
7876 Format: <string>7892 Format: <string>
7877 The RNG used to generate key material for trusted keys.7893 The RNG used to generate key material for trusted keys.
include/keys/request_key_auth-type.h+2−0
@@ -9,12 +9,14 @@ · 8 unmodified lines
9#define _KEYS_REQUEST_KEY_AUTH_TYPE_H9#define _KEYS_REQUEST_KEY_AUTH_TYPE_H
10 10
11#include <linux/key.h>11#include <linux/key.h>
12#include <linux/refcount.h>
12 13
13/*14/*
14 * Authorisation record for request_key().15 * Authorisation record for request_key().
15 */16 */
16struct request_key_auth {17struct request_key_auth {
17 struct rcu_head rcu;18 struct rcu_head rcu;
19 refcount_t usage;
18 struct key *target_key;20 struct key *target_key;
19 struct key *dest_keyring;21 struct key *dest_keyring;
20 const struct cred *cred;22 const struct cred *cred;
include/keys/trusted-type.h+12−9
@@ -83,18 +83,21 @@ struct trusted_key_source { · 82 unmodified lines
83 83
84extern struct key_type key_type_trusted;84extern struct key_type key_type_trusted;
85 85
86#define TRUSTED_DEBUG 086#ifdef CONFIG_TRUSTED_KEYS_DEBUG
87extern bool trusted_debug;
87 88
88#if TRUSTED_DEBUG
89static inline void dump_payload(struct trusted_key_payload *p)89static inline void dump_payload(struct trusted_key_payload *p)
90{90{
91 pr_info("key_len %d\n", p->key_len);91 if (!trusted_debug)
92 print_hex_dump(KERN_INFO, "key ", DUMP_PREFIX_NONE,92 return;
93 16, 1, p->key, p->key_len, 0);93
94 pr_info("bloblen %d\n", p->blob_len);94 pr_debug("key_len %d\n", p->key_len);
95 print_hex_dump(KERN_INFO, "blob ", DUMP_PREFIX_NONE,95 print_hex_dump_debug("key ", DUMP_PREFIX_NONE,
96 16, 1, p->blob, p->blob_len, 0);96 16, 1, p->key, p->key_len, 0);
97 pr_info("migratable %d\n", p->migratable);97 pr_debug("bloblen %d\n", p->blob_len);
98 print_hex_dump_debug("blob ", DUMP_PREFIX_NONE,
99 16, 1, p->blob, p->blob_len, 0);
100 pr_debug("migratable %d\n", p->migratable);
98}101}
99#else102#else
100static inline void dump_payload(struct trusted_key_payload *p)103static inline void dump_payload(struct trusted_key_payload *p)
security/keys/Kconfig+0−1
@@ -87,7 +87,6 @@ config ENCRYPTED_KEYS · 86 unmodified lines
87 select CRYPTO_AES87 select CRYPTO_AES
88 select CRYPTO_CBC88 select CRYPTO_CBC
89 select CRYPTO_LIB_SHA25689 select CRYPTO_LIB_SHA256
90 select CRYPTO_RNG
91 help90 help
92 This option provides support for create/encrypting/decrypting keys91 This option provides support for create/encrypting/decrypting keys
93 in the kernel. Encrypted keys are instantiated using kernel92 in the kernel. Encrypted keys are instantiated using kernel
security/keys/encrypted-keys/encrypted.c+2−2
@@ -343,9 +343,9 @@ static int get_derived_key(u8 *derived_key, enum derived_key_type key_type, · 342 unmodified lines
343 return -ENOMEM;343 return -ENOMEM;
344 344
345 if (key_type)345 if (key_type)
346 strcpy(derived_buf, "AUTH_KEY");346 strscpy(derived_buf, "AUTH_KEY", HASH_SIZE);
347 else347 else
348 strcpy(derived_buf, "ENC_KEY");348 strscpy(derived_buf, "ENC_KEY", HASH_SIZE);
349 349
350 memcpy(derived_buf + strlen(derived_buf) + 1, master_key,350 memcpy(derived_buf + strlen(derived_buf) + 1, master_key,
351 master_keylen);351 master_keylen);
security/keys/internal.h+2−0
@@ -208,6 +208,8 @@ extern struct key *request_key_auth_new(struct key *target, · 207 unmodified lines
208 const void *callout_info,208 const void *callout_info,
209 size_t callout_len,209 size_t callout_len,
210 struct key *dest_keyring);210 struct key *dest_keyring);
211struct request_key_auth *request_key_auth_get(struct key *authkey);
212void request_key_auth_put(struct request_key_auth *rka);
211 213
212extern struct key *key_get_instantiation_authkey(key_serial_t target_id);214extern struct key *key_get_instantiation_authkey(key_serial_t target_id);
213 215
security/keys/key.c+1−1
@@ -1275,7 +1275,7 @@ void __init key_init(void) · 1274 unmodified lines
1275{1275{
1276 /* allocate a slab in which we can store keys */1276 /* allocate a slab in which we can store keys */
1277 key_jar = kmem_cache_create("key_jar", sizeof(struct key),1277 key_jar = kmem_cache_create("key_jar", sizeof(struct key),
1278 0, SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);1278 0, SLAB_HWCACHE_ALIGN | SLAB_PANIC | SLAB_NO_MERGE, NULL);
1279 1279
1280 /* add the special key types */1280 /* add the special key types */
1281 list_add_tail(&key_type_keyring.link, &key_types_list);1281 list_add_tail(&key_type_keyring.link, &key_types_list);
security/keys/keyctl.c+18−6
@@ -1197,9 +1197,13 @@ static long keyctl_instantiate_key_common(key_serial_t id, · 1196 unmodified lines
1197 if (!instkey)1197 if (!instkey)
1198 goto error;1198 goto error;
1199 1199
1200 rka = instkey->payload.data[0];1200 rka = request_key_auth_get(instkey);
1201 if (rka->target_key->serial != id)1201 if (!rka) {
1202 ret = -EKEYREVOKED;
1202 goto error;1203 goto error;
1204 }
1205 if (rka->target_key->serial != id)
1206 goto error_put_rka;
1203 1207
1204 /* pull the payload in if one was supplied */1208 /* pull the payload in if one was supplied */
1205 payload = NULL;1209 payload = NULL;
@@ -1208,7 +1212,7 @@ static long keyctl_instantiate_key_common(key_serial_t id, · 2 unmodified lines
1208 ret = -ENOMEM;1212 ret = -ENOMEM;
1209 payload = kvmalloc(plen, GFP_KERNEL);1213 payload = kvmalloc(plen, GFP_KERNEL);
1210 if (!payload)1214 if (!payload)
1211 goto error;1215 goto error_put_rka;
1212 1216
1213 ret = -EFAULT;1217 ret = -EFAULT;
1214 if (!copy_from_iter_full(payload, plen, from))1218 if (!copy_from_iter_full(payload, plen, from))
@@ -1234,6 +1238,8 @@ static long keyctl_instantiate_key_common(key_serial_t id, · 19 unmodified lines
1234 1238
1235error2:1239error2:
1236 kvfree_sensitive(payload, plen);1240 kvfree_sensitive(payload, plen);
1241error_put_rka:
1242 request_key_auth_put(rka);
1237error:1243error:
1238 return ret;1244 return ret;
1239}1245}
@@ -1358,15 +1364,19 @@ long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error, · 118 unmodified lines
1358 if (!instkey)1364 if (!instkey)
1359 goto error;1365 goto error;
1360 1366
1361 rka = instkey->payload.data[0];1367 rka = request_key_auth_get(instkey);
1362 if (rka->target_key->serial != id)1368 if (!rka) {
1369 ret = -EKEYREVOKED;
1363 goto error;1370 goto error;
1371 }
1372 if (rka->target_key->serial != id)
1373 goto error_put_rka;
1364 1374
1365 /* find the destination keyring if present (which must also be1375 /* find the destination keyring if present (which must also be
1366 * writable) */1376 * writable) */
1367 ret = get_instantiation_keyring(ringid, rka, &dest_keyring);1377 ret = get_instantiation_keyring(ringid, rka, &dest_keyring);
1368 if (ret < 0)1378 if (ret < 0)
1369 goto error;1379 goto error_put_rka;
1370 1380
1371 /* instantiate the key and link it into a keyring */1381 /* instantiate the key and link it into a keyring */
1372 ret = key_reject_and_link(rka->target_key, timeout, error,1382 ret = key_reject_and_link(rka->target_key, timeout, error,
@@ -1379,6 +1389,8 @@ long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error, · 6 unmodified lines
1379 if (ret == 0)1389 if (ret == 0)
1380 keyctl_change_reqkey_auth(NULL);1390 keyctl_change_reqkey_auth(NULL);
1381 1391
1392error_put_rka:
1393 request_key_auth_put(rka);
1382error:1394error:
1383 return ret;1395 return ret;
1384}1396}
security/keys/keyctl_pkey.c+11−3
@@ -138,28 +138,35 @@ static int keyctl_pkey_params_get_2(const struct keyctl_pkey_params __user *_par · 137 unmodified lines
138 if (uparams.in_len > info.max_dec_size ||138 if (uparams.in_len > info.max_dec_size ||
139 uparams.out_len > info.max_enc_size)139 uparams.out_len > info.max_enc_size)
140 return -EINVAL;140 return -EINVAL;
141
142 params->out_len = info.max_enc_size;
141 break;143 break;
142 case KEYCTL_PKEY_DECRYPT:144 case KEYCTL_PKEY_DECRYPT:
143 if (uparams.in_len > info.max_enc_size ||145 if (uparams.in_len > info.max_enc_size ||
144 uparams.out_len > info.max_dec_size)146 uparams.out_len > info.max_dec_size)
145 return -EINVAL;147 return -EINVAL;
148
149 params->out_len = info.max_dec_size;
146 break;150 break;
147 case KEYCTL_PKEY_SIGN:151 case KEYCTL_PKEY_SIGN:
148 if (uparams.in_len > info.max_data_size ||152 if (uparams.in_len > info.max_data_size ||
149 uparams.out_len > info.max_sig_size)153 uparams.out_len > info.max_sig_size)
150 return -EINVAL;154 return -EINVAL;
155
156 params->out_len = info.max_sig_size;
151 break;157 break;
152 case KEYCTL_PKEY_VERIFY:158 case KEYCTL_PKEY_VERIFY:
153 if (uparams.in_len > info.max_data_size ||159 if (uparams.in_len > info.max_data_size ||
154 uparams.in2_len > info.max_sig_size)160 uparams.in2_len > info.max_sig_size)
155 return -EINVAL;161 return -EINVAL;
162
163 params->out_len = info.max_sig_size;
156 break;164 break;
157 default:165 default:
158 BUG();166 return -EOPNOTSUPP;
159 }167 }
160 168
161 params->in_len = uparams.in_len;169 params->in_len = uparams.in_len;
162 params->out_len = uparams.out_len; /* Note: same as in2_len */
163 return 0;170 return 0;
164}171}
165 172
@@ -238,7 +245,8 @@ long keyctl_pkey_e_d_s(int op, · 72 unmodified lines
238 params.op = kernel_pkey_sign;245 params.op = kernel_pkey_sign;
239 break;246 break;
240 default:247 default:
241 BUG();248 ret = -EOPNOTSUPP;
249 goto error_params;
242 }250 }
243 251
244 in = memdup_user(_in, params.in_len);252 in = memdup_user(_in, params.in_len);
security/keys/keyring.c+1−1
@@ -576,7 +576,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data) · 575 unmodified lines
576 struct keyring_search_context *ctx = iterator_data;576 struct keyring_search_context *ctx = iterator_data;
577 const struct key *key = keyring_ptr_to_key(object);577 const struct key *key = keyring_ptr_to_key(object);
578 unsigned long kflags = READ_ONCE(key->flags);578 unsigned long kflags = READ_ONCE(key->flags);
579 short state = READ_ONCE(key->state);579 short state = key_read_state(key);
580 580
581 kenter("{%d}", key->serial);581 kenter("{%d}", key->serial);
582 582
security/keys/request_key.c+1−1
@@ -332,7 +332,7 @@ static int construct_get_dest_keyring(struct key **_dest_keyring) · 331 unmodified lines
332 332
333 case KEY_REQKEY_DEFL_GROUP_KEYRING:333 case KEY_REQKEY_DEFL_GROUP_KEYRING:
334 default:334 default:
335 BUG();335 return -EINVAL;
336 }336 }
337 337
338 /*338 /*
security/keys/request_key_auth.c+31−2
@@ -23,6 +23,7 @@ static void request_key_auth_describe(const struct key *, struct seq_file *); · 22 unmodified lines
23static void request_key_auth_revoke(struct key *);23static void request_key_auth_revoke(struct key *);
24static void request_key_auth_destroy(struct key *);24static void request_key_auth_destroy(struct key *);
25static long request_key_auth_read(const struct key *, char *, size_t);25static long request_key_auth_read(const struct key *, char *, size_t);
26static void request_key_auth_rcu_disposal(struct rcu_head *);
26 27
27/*28/*
28 * The request-key authorisation key type definition.29 * The request-key authorisation key type definition.
@@ -115,6 +116,31 @@ static void free_request_key_auth(struct request_key_auth *rka) · 86 unmodified lines
115 kfree(rka);116 kfree(rka);
116}117}
117 118
119/*
120 * Take a reference to the request-key authorisation payload so callers can
121 * drop authkey->sem before doing operations that may sleep.
122 */
123struct request_key_auth *request_key_auth_get(struct key *authkey)
124{
125 struct request_key_auth *rka;
126
127 down_read(&authkey->sem);
128 rka = dereference_key_locked(authkey);
129 if (rka && !test_bit(KEY_FLAG_REVOKED, &authkey->flags))
130 refcount_inc(&rka->usage);
131 else
132 rka = NULL;
133 up_read(&authkey->sem);
134
135 return rka;
136}
137
138void request_key_auth_put(struct request_key_auth *rka)
139{
140 if (rka && refcount_dec_and_test(&rka->usage))
141 call_rcu(&rka->rcu, request_key_auth_rcu_disposal);
142}
143
118/*144/*
119 * Dispose of the request_key_auth record under RCU conditions145 * Dispose of the request_key_auth record under RCU conditions
120 */146 */
@@ -136,8 +162,10 @@ static void request_key_auth_revoke(struct key *key) · 15 unmodified lines
136 struct request_key_auth *rka = dereference_key_locked(key);162 struct request_key_auth *rka = dereference_key_locked(key);
137 163
138 kenter("{%d}", key->serial);164 kenter("{%d}", key->serial);
165 if (!rka)
166 return;
139 rcu_assign_keypointer(key, NULL);167 rcu_assign_keypointer(key, NULL);
140 call_rcu(&rka->rcu, request_key_auth_rcu_disposal);168 request_key_auth_put(rka);
141}169}
142 170
143/*171/*
@@ -150,7 +178,7 @@ static void request_key_auth_destroy(struct key *key) · 6 unmodified lines
150 kenter("{%d}", key->serial);178 kenter("{%d}", key->serial);
151 if (rka) {179 if (rka) {
152 rcu_assign_keypointer(key, NULL);180 rcu_assign_keypointer(key, NULL);
153 call_rcu(&rka->rcu, request_key_auth_rcu_disposal);181 request_key_auth_put(rka);
154 }182 }
155}183}
156 184
@@ -174,6 +202,7 @@ struct key *request_key_auth_new(struct key *target, const char *op, · 17 unmodified lines
174 rka = kzalloc_obj(*rka);202 rka = kzalloc_obj(*rka);
175 if (!rka)203 if (!rka)
176 goto error;204 goto error;
205 refcount_set(&rka->usage, 1);
177 rka->callout_info = kmemdup(callout_info, callout_len, GFP_KERNEL);206 rka->callout_info = kmemdup(callout_info, callout_len, GFP_KERNEL);
178 if (!rka->callout_info)207 if (!rka->callout_info)
179 goto error_free_rka;208 goto error_free_rka;
security/keys/trusted-keys/Kconfig+23−0
@@ -1,10 +1,29 @@
1config HAVE_TRUSTED_KEYS1config HAVE_TRUSTED_KEYS
2 bool2 bool
3 3
4config HAVE_TRUSTED_KEYS_DEBUG
5 bool
6
7config TRUSTED_KEYS_DEBUG
8 bool "Debug trusted keys"
9 depends on HAVE_TRUSTED_KEYS_DEBUG
10 default n
11 help
12 Trusted key backends and core code that support debug traces can
13 opt-in that feature here. Traces must only use debug level output, as
14 sensitive data may pass by. In the kernel-command line traces can be
15 enabled via trusted.dyndbg='+p'.
16
17 SAFETY: Debug dumps are inactive at runtime until trusted.debug is set
18 to a true value on the kernel command-line. Use at your utmost
19 consideration when enabling this feature on a production build. The
20 general advice is not to do this.
21
4config TRUSTED_KEYS_TPM22config TRUSTED_KEYS_TPM
5 bool "TPM-based trusted keys"23 bool "TPM-based trusted keys"
6 depends on TCG_TPM >= TRUSTED_KEYS24 depends on TCG_TPM >= TRUSTED_KEYS
7 default y25 default y
26 select HAVE_TRUSTED_KEYS_DEBUG
8 select CRYPTO_HASH_INFO27 select CRYPTO_HASH_INFO
9 select CRYPTO_LIB_SHA128 select CRYPTO_LIB_SHA1
10 select CRYPTO_LIB_UTILS29 select CRYPTO_LIB_UTILS
@@ -23,6 +42,7 @@ config TRUSTED_KEYS_TEE · 12 unmodified lines
23 bool "TEE-based trusted keys"42 bool "TEE-based trusted keys"
24 depends on TEE >= TRUSTED_KEYS43 depends on TEE >= TRUSTED_KEYS
25 default y44 default y
45 select HAVE_TRUSTED_KEYS_DEBUG
26 select HAVE_TRUSTED_KEYS46 select HAVE_TRUSTED_KEYS
27 help47 help
28 Enable use of the Trusted Execution Environment (TEE) as trusted48 Enable use of the Trusted Execution Environment (TEE) as trusted
@@ -33,6 +53,7 @@ config TRUSTED_KEYS_CAAM · 4 unmodified lines
33 depends on CRYPTO_DEV_FSL_CAAM_JR >= TRUSTED_KEYS53 depends on CRYPTO_DEV_FSL_CAAM_JR >= TRUSTED_KEYS
34 select CRYPTO_DEV_FSL_CAAM_BLOB_GEN54 select CRYPTO_DEV_FSL_CAAM_BLOB_GEN
35 default y55 default y
56 select HAVE_TRUSTED_KEYS_DEBUG
36 select HAVE_TRUSTED_KEYS57 select HAVE_TRUSTED_KEYS
37 help58 help
38 Enable use of NXP's Cryptographic Accelerator and Assurance Module59 Enable use of NXP's Cryptographic Accelerator and Assurance Module
@@ -42,6 +63,7 @@ config TRUSTED_KEYS_DCP · 3 unmodified lines
42 bool "DCP-based trusted keys"63 bool "DCP-based trusted keys"
43 depends on CRYPTO_DEV_MXS_DCP >= TRUSTED_KEYS64 depends on CRYPTO_DEV_MXS_DCP >= TRUSTED_KEYS
44 default y65 default y
66 select HAVE_TRUSTED_KEYS_DEBUG
45 select HAVE_TRUSTED_KEYS67 select HAVE_TRUSTED_KEYS
46 help68 help
47 Enable use of NXP's DCP (Data Co-Processor) as trusted key backend.69 Enable use of NXP's DCP (Data Co-Processor) as trusted key backend.
@@ -50,6 +72,7 @@ config TRUSTED_KEYS_PKWM · 2 unmodified lines
50 bool "PKWM-based trusted keys"72 bool "PKWM-based trusted keys"
51 depends on PSERIES_PLPKS >= TRUSTED_KEYS73 depends on PSERIES_PLPKS >= TRUSTED_KEYS
52 default y74 default y
75 select HAVE_TRUSTED_KEYS_DEBUG
53 select HAVE_TRUSTED_KEYS76 select HAVE_TRUSTED_KEYS
54 help77 help
55 Enable use of IBM PowerVM Key Wrapping Module (PKWM) as a trusted key backend.78 Enable use of IBM PowerVM Key Wrapping Module (PKWM) as a trusted key backend.
security/keys/trusted-keys/trusted_caam.c+5−2
@@ -28,10 +28,13 @@ static const match_table_t key_tokens = { · 27 unmodified lines
28 {opt_err, NULL}28 {opt_err, NULL}
29};29};
30 30
31#ifdef CAAM_DEBUG31#ifdef CONFIG_TRUSTED_KEYS_DEBUG
32static inline void dump_options(const struct caam_pkey_info *pkey_info)32static inline void dump_options(const struct caam_pkey_info *pkey_info)
33{33{
34 pr_info("key encryption algo %d\n", pkey_info->key_enc_algo);34 if (!trusted_debug)
35 return;
36
37 pr_debug("key encryption algo %d\n", pkey_info->key_enc_algo);
35}38}
36#else39#else
37static inline void dump_options(const struct caam_pkey_info *pkey_info)40static inline void dump_options(const struct caam_pkey_info *pkey_info)
security/keys/trusted-keys/trusted_core.c+7−1
@@ -31,6 +31,12 @@ static char *trusted_rng = "default"; · 30 unmodified lines
31module_param_named(rng, trusted_rng, charp, 0);31module_param_named(rng, trusted_rng, charp, 0);
32MODULE_PARM_DESC(rng, "Select trusted key RNG");32MODULE_PARM_DESC(rng, "Select trusted key RNG");
33 33
34#ifdef CONFIG_TRUSTED_KEYS_DEBUG
35bool trusted_debug;
36module_param_named(debug, trusted_debug, bool, 0);
37MODULE_PARM_DESC(debug, "Enable trusted keys debug traces (default: 0)");
38#endif
39
34static char *trusted_key_source;40static char *trusted_key_source;
35module_param_named(source, trusted_key_source, charp, 0);41module_param_named(source, trusted_key_source, charp, 0);
36MODULE_PARM_DESC(source, "Select trusted keys source (tpm, tee, caam, dcp or pkwm)");42MODULE_PARM_DESC(source, "Select trusted keys source (tpm, tee, caam, dcp or pkwm)");
@@ -59,7 +65,7 @@ DEFINE_STATIC_CALL_NULL(trusted_key_unseal, · 22 unmodified lines
59DEFINE_STATIC_CALL_NULL(trusted_key_get_random,65DEFINE_STATIC_CALL_NULL(trusted_key_get_random,
60 *trusted_key_sources[0].ops->get_random);66 *trusted_key_sources[0].ops->get_random);
61static void (*trusted_key_exit)(void);67static void (*trusted_key_exit)(void);
62static unsigned char migratable;68static unsigned char migratable __ro_after_init;
63 69
64enum {70enum {
65 Opt_err,71 Opt_err,
security/keys/trusted-keys/trusted_tpm1.c+25−19
@@ -46,38 +46,44 @@ enum { · 45 unmodified lines
46 SRK_keytype = 446 SRK_keytype = 4
47};47};
48 48
49#define TPM_DEBUG 049#ifdef CONFIG_TRUSTED_KEYS_DEBUG
50
51#if TPM_DEBUG
52static inline void dump_options(struct trusted_key_options *o)50static inline void dump_options(struct trusted_key_options *o)
53{51{
54 pr_info("sealing key type %d\n", o->keytype);52 if (!trusted_debug)
55 pr_info("sealing key handle %0X\n", o->keyhandle);53 return;
56 pr_info("pcrlock %d\n", o->pcrlock);54
57 pr_info("pcrinfo %d\n", o->pcrinfo_len);55 pr_debug("sealing key type %d\n", o->keytype);
58 print_hex_dump(KERN_INFO, "pcrinfo ", DUMP_PREFIX_NONE,56 pr_debug("sealing key handle %0X\n", o->keyhandle);
59 16, 1, o->pcrinfo, o->pcrinfo_len, 0);57 pr_debug("pcrlock %d\n", o->pcrlock);
58 pr_debug("pcrinfo %d\n", o->pcrinfo_len);
59 print_hex_dump_debug("pcrinfo ", DUMP_PREFIX_NONE,
60 16, 1, o->pcrinfo, o->pcrinfo_len, 0);
60}61}
61 62
62static inline void dump_sess(struct osapsess *s)63static inline void dump_sess(struct osapsess *s)
63{64{
64 print_hex_dump(KERN_INFO, "trusted-key: handle ", DUMP_PREFIX_NONE,65 if (!trusted_debug)
65 16, 1, &s->handle, 4, 0);66 return;
66 pr_info("secret:\n");67
67 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE,68 print_hex_dump_debug("trusted-key: handle ", DUMP_PREFIX_NONE,
68 16, 1, &s->secret, SHA1_DIGEST_SIZE, 0);69 16, 1, &s->handle, 4, 0);
69 pr_info("trusted-key: enonce:\n");70 pr_debug("secret:\n");
70 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE,71 print_hex_dump_debug("", DUMP_PREFIX_NONE,
71 16, 1, &s->enonce, SHA1_DIGEST_SIZE, 0);72 16, 1, &s->secret, SHA1_DIGEST_SIZE, 0);
73 pr_debug("trusted-key: enonce:\n");
74 print_hex_dump_debug("", DUMP_PREFIX_NONE,
75 16, 1, &s->enonce, SHA1_DIGEST_SIZE, 0);
72}76}
73 77
74static inline void dump_tpm_buf(unsigned char *buf)78static inline void dump_tpm_buf(unsigned char *buf)
75{79{
76 int len;80 int len;
77 81
78 pr_info("\ntpm buffer\n");82 if (!trusted_debug)
83 return;
84 pr_debug("\ntpm buffer\n");
79 len = LOAD32(buf, TPM_SIZE_OFFSET);85 len = LOAD32(buf, TPM_SIZE_OFFSET);
80 print_hex_dump(KERN_INFO, "", DUMP_PREFIX_NONE, 16, 1, buf, len, 0);86 print_hex_dump_debug("", DUMP_PREFIX_NONE, 16, 1, buf, len, 0);
81}87}
82#else88#else
83static inline void dump_options(struct trusted_key_options *o)89static inline void dump_options(struct trusted_key_options *o)
security/keys/user_defined.c+1−1
@@ -64,7 +64,7 @@ int user_preparse(struct key_preparsed_payload *prep) · 63 unmodified lines
64 if (datalen == 0 || datalen > 32767 || !prep->data)64 if (datalen == 0 || datalen > 32767 || !prep->data)
65 return -EINVAL;65 return -EINVAL;
66 66
67 upayload = kmalloc(sizeof(*upayload) + datalen, GFP_KERNEL);67 upayload = kmalloc_flex(*upayload, data, datalen);
68 if (!upayload)68 if (!upayload)
69 return -ENOMEM;69 return -ENOMEM;
70 70