Pull trusted keys fixes from Jarkko Sakkinen: "These are two bugs I found from trusted keys while working on a new RSA key type for TPM2. Both originate form v5.13. The memory leak is more crucial but I don't think it is either good idea if kernel throws WARN when ASN.1 parser fails, even if it is related to programming error, as it is not that mature code yet. There's at least two WARN's in that code but I picked just the one more likely to trigger. Planning to fix the other one too over time" * tag 'keys-trusted-next-6.10-rc1-part2' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd: KEYS: trusted: Do not use WARN when encode fails KEYS: trusted: Fix memory leak in tpm2_key_encode()
Unified · Split
| @@ -38,6 +38,7 @@ static int tpm2_key_encode(struct trusted_key_payload *payload, · 37 unmodified lines | |||
| 38 | u8 *end_work = scratch + SCRATCH_SIZE; | 38 | u8 *end_work = scratch + SCRATCH_SIZE; |
| 39 | u8 *priv, *pub; | 39 | u8 *priv, *pub; |
| 40 | u16 priv_len, pub_len; | 40 | u16 priv_len, pub_len; |
| 41 | int ret; | ||
| 41 | 42 | ||
| 42 | priv_len = get_unaligned_be16(src) + 2; | 43 | priv_len = get_unaligned_be16(src) + 2; |
| 43 | priv = src; | 44 | priv = src; |
| @@ -57,8 +58,10 @@ static int tpm2_key_encode(struct trusted_key_payload *payload, · 13 unmodified lines | |||
| 57 | unsigned char bool[3], *w = bool; | 58 | unsigned char bool[3], *w = bool; |
| 58 | /* tag 0 is emptyAuth */ | 59 | /* tag 0 is emptyAuth */ |
| 59 | w = asn1_encode_boolean(w, w + sizeof(bool), true); | 60 | w = asn1_encode_boolean(w, w + sizeof(bool), true); |
| 60 | if (WARN(IS_ERR(w), "BUG: Boolean failed to encode")) | 61 | if (WARN(IS_ERR(w), "BUG: Boolean failed to encode")) { |
| 61 | return PTR_ERR(w); | 62 | ret = PTR_ERR(w); |
| 63 | goto err; | ||
| 64 | } | ||
| 62 | work = asn1_encode_tag(work, end_work, 0, bool, w - bool); | 65 | work = asn1_encode_tag(work, end_work, 0, bool, w - bool); |
| 63 | } | 66 | } |
| 64 | 67 | ||
| @@ -69,8 +72,10 @@ static int tpm2_key_encode(struct trusted_key_payload *payload, · 4 unmodified lines | |||
| 69 | * trigger, so if it does there's something nefarious going on | 72 | * trigger, so if it does there's something nefarious going on |
| 70 | */ | 73 | */ |
| 71 | if (WARN(work - scratch + pub_len + priv_len + 14 > SCRATCH_SIZE, | 74 | if (WARN(work - scratch + pub_len + priv_len + 14 > SCRATCH_SIZE, |
| 72 | "BUG: scratch buffer is too small")) | 75 | "BUG: scratch buffer is too small")) { |
| 73 | return -EINVAL; | 76 | ret = -EINVAL; |
| 77 | goto err; | ||
| 78 | } | ||
| 74 | 79 | ||
| 75 | work = asn1_encode_integer(work, end_work, options->keyhandle); | 80 | work = asn1_encode_integer(work, end_work, options->keyhandle); |
| 76 | work = asn1_encode_octet_string(work, end_work, pub, pub_len); | 81 | work = asn1_encode_octet_string(work, end_work, pub, pub_len); |
| @@ -79,10 +84,18 @@ static int tpm2_key_encode(struct trusted_key_payload *payload, · 2 unmodified lines | |||
| 79 | work1 = payload->blob; | 84 | work1 = payload->blob; |
| 80 | work1 = asn1_encode_sequence(work1, work1 + sizeof(payload->blob), | 85 | work1 = asn1_encode_sequence(work1, work1 + sizeof(payload->blob), |
| 81 | scratch, work - scratch); | 86 | scratch, work - scratch); |
| 82 | if (WARN(IS_ERR(work1), "BUG: ASN.1 encoder failed")) | 87 | if (IS_ERR(work1)) { |
| 83 | return PTR_ERR(work1); | 88 | ret = PTR_ERR(work1); |
| 89 | pr_err("BUG: ASN.1 encoder failed with %d\n", ret); | ||
| 90 | goto err; | ||
| 91 | } | ||
| 84 | 92 | ||
| 93 | kfree(scratch); | ||
| 85 | return work1 - payload->blob; | 94 | return work1 - payload->blob; |
| 95 | |||
| 96 | err: | ||
| 97 | kfree(scratch); | ||
| 98 | return ret; | ||
| 86 | } | 99 | } |
| 87 | 100 | ||
| 88 | struct tpm2_key_context { | 101 | struct tpm2_key_context { |