summaryrefslogtreecommitdiffstats
path: root/security
diff options
context:
space:
mode:
authorEric Biggers <ebiggers@google.com>2017-06-08 14:49:34 +0100
committerJames Morris <james.l.morris@oracle.com>2017-06-09 13:29:49 +1000
commitbbe240454d86be95151e0ecfd6ac55fe5ef5a6f5 (patch)
tree662839ffc98b691fe598cef81a1bab0c2b123ccd /security
parent0620fddb56dfaf0e1034eeb69d79c73b361debbf (diff)
downloadlinux-bbe240454d86be95151e0ecfd6ac55fe5ef5a6f5.tar.gz
linux-bbe240454d86be95151e0ecfd6ac55fe5ef5a6f5.tar.bz2
linux-bbe240454d86be95151e0ecfd6ac55fe5ef5a6f5.zip
KEYS: DH: forbid using digest_null as the KDF hash
Requesting "digest_null" in the keyctl_kdf_params caused an infinite loop in kdf_ctr() because the "null" hash has a digest size of 0. Fix it by rejecting hash algorithms with a digest size of 0. Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Acked-by: Stephan Mueller <smueller@chronox.de> Signed-off-by: James Morris <james.l.morris@oracle.com>
Diffstat (limited to 'security')
-rw-r--r--security/keys/dh.c12
1 files changed, 11 insertions, 1 deletions
diff --git a/security/keys/dh.c b/security/keys/dh.c
index e603bd912e4c..8abc70ebe22d 100644
--- a/security/keys/dh.c
+++ b/security/keys/dh.c
@@ -89,6 +89,7 @@ static int kdf_alloc(struct kdf_sdesc **sdesc_ret, char *hashname)
struct crypto_shash *tfm;
struct kdf_sdesc *sdesc;
int size;
+ int err;
/* allocate synchronous hash */
tfm = crypto_alloc_shash(hashname, 0, 0);
@@ -97,16 +98,25 @@ static int kdf_alloc(struct kdf_sdesc **sdesc_ret, char *hashname)
return PTR_ERR(tfm);
}
+ err = -EINVAL;
+ if (crypto_shash_digestsize(tfm) == 0)
+ goto out_free_tfm;
+
+ err = -ENOMEM;
size = sizeof(struct shash_desc) + crypto_shash_descsize(tfm);
sdesc = kmalloc(size, GFP_KERNEL);
if (!sdesc)
- return -ENOMEM;
+ goto out_free_tfm;
sdesc->shash.tfm = tfm;
sdesc->shash.flags = 0x0;
*sdesc_ret = sdesc;
return 0;
+
+out_free_tfm:
+ crypto_free_shash(tfm);
+ return err;
}
static void kdf_dealloc(struct kdf_sdesc *sdesc)