s390/zcrypt: Fix CPRB memory allocation in zcrypt misc code

Both CPRB alloc functions in zcrypt_ccamisc.c and zcrypt_ep11misc.c
did not round up the memory allocation to a multiple of 4 bytes as it
is needed by the zcrypt layer to process the CPRBs.

Now the alloc_and_prep_cprbmem() and alloc_cprbmem() functions
guarantee that the base CPRB struct and a possible parameter block are
aligned to a 4-byte boundary and the backing memory allocation is
rounded up to the next multiple of 4 byte. Also the free_cprbmem() is
updated and scrubs the rounded up amount of memory.

Fixes: 9bdb5f7e8369 ("s390/zcrypt: Introduce cprb mempool for cca misc functions")
Signed-off-by: Harald Freudenberger <freude@linux.ibm.com>
Reviewed-by: Holger Dengler <dengler@linux.ibm.com>
Cc: stable@vger.kernel.org # 6.16+
Signed-off-by: Vasily Gorbik <gor@linux.ibm.com>

diff --git a/drivers/s390/crypto/zcrypt_ccamisc.c b/drivers/s390/crypto/zcrypt_ccamisc.c
index 86d2ee78c9f48cada96ccb5d19179a4fa354e618..d4ce6352b5b2e2bbe68595095cc8f74921ba4e82 100644 (file)
--- a/drivers/s390/crypto/zcrypt_ccamisc.c
+++ b/drivers/s390/crypto/zcrypt_ccamisc.c
@@ -15,6 +15,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/random.h>
+#include <linux/align.h>
 #include <asm/zcrypt.h>
 #include <asm/pkey.h>
 
@@ -267,6 +268,10 @@ EXPORT_SYMBOL(cca_check_sececckeytoken);
  * block, reply CPRB and reply param block and fill in values
  * for the common fields. Returns 0 on success or errno value
  * on failure.
+ * It is guaranteed that request and a possible param block
+ * are aligned to a 4 byte boundary. Furthermore if a param
+ * block is used, the memory allocated for this is rounded up to
+ * the next multiple of 4 bytes.
  */
 static int alloc_and_prep_cprbmem(size_t paramblen,
                                  u8 **p_cprb_mem,
@@ -275,7 +280,8 @@ static int alloc_and_prep_cprbmem(size_t paramblen,
                                  u32 xflags)
 {
        u8 *cprbmem = NULL;
-       size_t cprbplusparamblen = sizeof(struct CPRBX) + paramblen;
+       size_t cprbplusparamblen =
+               ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4);
        size_t len = 2 * cprbplusparamblen;
        struct CPRBX *preqcblk, *prepcblk;
 
@@ -302,10 +308,10 @@ static int alloc_and_prep_cprbmem(size_t paramblen,
        memcpy(preqcblk->func_id, "T2", 2);
        preqcblk->rpl_msgbl = cprbplusparamblen;
        if (paramblen) {
-               preqcblk->req_parmb =
-                       ((u8 __user *)preqcblk) + sizeof(struct CPRBX);
-               preqcblk->rpl_parmb =
-                       ((u8 __user *)prepcblk) + sizeof(struct CPRBX);
+               preqcblk->req_parmb = ((u8 __user *)preqcblk) +
+                       ALIGN(sizeof(struct CPRBX), 4);
+               preqcblk->rpl_parmb = ((u8 __user *)prepcblk) +
+                       ALIGN(sizeof(struct CPRBX), 4);
        }
 
        *p_cprb_mem = cprbmem;
@@ -323,8 +329,10 @@ static int alloc_and_prep_cprbmem(size_t paramblen,
  */
 static void free_cprbmem(void *mem, size_t paramblen, bool scrub, u32 xflags)
 {
+       size_t cprblen = ALIGN(sizeof(struct CPRBX), 4) + ALIGN(paramblen, 4);
+
        if (mem && scrub)
-               memzero_explicit(mem, 2 * (sizeof(struct CPRBX) + paramblen));
+               memzero_explicit(mem, 2 * cprblen);
 
        if (xflags & ZCRYPT_XFLAG_NOMEMALLOC)
                mempool_free(mem, cprb_mempool);

diff --git a/drivers/s390/crypto/zcrypt_ep11misc.c b/drivers/s390/crypto/zcrypt_ep11misc.c
index 3dda9589f2b955622eabdd2cb07bf604f11841f4..2d900ffc5068acbfca926be3a4082d9d1a6727dc 100644 (file)
--- a/drivers/s390/crypto/zcrypt_ep11misc.c
+++ b/drivers/s390/crypto/zcrypt_ep11misc.c
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/random.h>
 #include <linux/slab.h>
+#include <linux/align.h>
 #include <asm/zcrypt.h>
 #include <asm/pkey.h>
 #include <crypto/aes.h>
@@ -355,21 +356,24 @@ EXPORT_SYMBOL(ep11_check_aes_key);
 
 /*
  * Allocate and prepare ep11 cprb plus additional payload.
+ * It is guaranteed that the memory is aligned to a 4 byte boundary.
+ * Furthermore the memory allocation is rounded up to the next
+ * multiple of 4 bytes (with taking the payload_len into account).
  */
 static void *alloc_cprbmem(size_t payload_len, u32 xflags)
 {
-       size_t len = sizeof(struct ep11_cprb) + payload_len;
+       size_t memlen = ALIGN(sizeof(struct ep11_cprb) + payload_len, 4);
        struct ep11_cprb *cprb = NULL;
 
        if (xflags & ZCRYPT_XFLAG_NOMEMALLOC) {
-               if (len <= CPRB_MEMPOOL_ITEM_SIZE)
+               if (memlen <= CPRB_MEMPOOL_ITEM_SIZE)
                        cprb = mempool_alloc_preallocated(cprb_mempool);
        } else {
-               cprb = kmalloc(len, GFP_KERNEL);
+               cprb = kmalloc(memlen, GFP_KERNEL);
        }
        if (!cprb)
                return NULL;
-       memset(cprb, 0, len);
+       memset(cprb, 0, memlen);
 
        cprb->cprb_len = sizeof(struct ep11_cprb);
        cprb->cprb_ver_id = 0x04;
@@ -385,8 +389,10 @@ static void *alloc_cprbmem(size_t payload_len, u32 xflags)
  */
 static void free_cprbmem(void *mem, size_t payload_len, bool scrub, u32 xflags)
 {
+       size_t memlen = ALIGN(sizeof(struct ep11_cprb) + payload_len, 4);
+
        if (mem && scrub)
-               memzero_explicit(mem, sizeof(struct ep11_cprb) + payload_len);
+               memzero_explicit(mem, memlen);
 
        if (xflags & ZCRYPT_XFLAG_NOMEMALLOC)
                mempool_free(mem, cprb_mempool);