s390/zcrypt: Validate length for CCA AES cipher key requests

cca_cipher2protkey() derives the copy length for the CPRB parameter
block directly from the length field in the key token. Reject the
request early if the token length exceeds the available space in the
parameter block.

Fixes: 4bc123b18ce6 ("s390/zcrypt: Add low level functions for CCA AES cipher keys")
Signed-off-by: Holger Dengler <dengler@linux.ibm.com>
Cc: stable@vger.kernel.org # 5.4+
Reviewed-by: Harald Freudenberger <freude@linux.ibm.com>
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>

diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
index 84936a795b956c16aac4f7192b0eb3429f07579b..db6a4211a97e0a0e42be6654eea95a20df719c94 100644 (file)
--- a/drivers/s390/crypto/zcrypt_ccamisc.c
+++ b/drivers/s390/crypto/zcrypt_ccamisc.c
@@ -1261,6 +1261,9 @@ int cca_cipher2protkey(u16 cardnr, u16 domain, const u8 *ckey,
        } __packed * prepparm;
        int keytoklen = ((struct cipherkeytoken *)ckey)->len;
 
+       if (keytoklen > PARMBSIZE - sizeof(struct aureqparm))
+               return -EINVAL;
+
        /* get already prepared memory for 2 cprbs with param block each */
        rc = alloc_and_prep_cprbmem(PARMBSIZE, &mem,
                                    &preqcblk, &prepcblk, xflags);