linux-kernel - Re: [RFC PATCH v3 03/13] clavis: Introduce a new system keyring called clavis

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <31abac4eb64404494395ee6ecc7fc697e0cad0af.camel@kernel.org>
Date: Fri, 18 Oct 2024 00:16:22 +0300
From: Jarkko Sakkinen <jarkko@...nel.org>
To: Eric Snowberg <eric.snowberg@...cle.com>
Cc: "open list:SECURITY SUBSYSTEM" <linux-security-module@...r.kernel.org>, 
 David Howells <dhowells@...hat.com>, David Woodhouse <dwmw2@...radead.org>,
 "herbert@...dor.apana.org.au" <herbert@...dor.apana.org.au>,
 "davem@...emloft.net" <davem@...emloft.net>,  Ard Biesheuvel
 <ardb@...nel.org>, Paul Moore <paul@...l-moore.com>, James Morris
 <jmorris@...ei.org>, "Serge E. Hallyn" <serge@...lyn.com>, Mimi Zohar
 <zohar@...ux.ibm.com>, Roberto Sassu <roberto.sassu@...wei.com>, Dmitry
 Kasatkin <dmitry.kasatkin@...il.com>, Mickaël Salaün
 <mic@...ikod.net>,  "casey@...aufler-ca.com" <casey@...aufler-ca.com>,
 Stefan Berger <stefanb@...ux.ibm.com>,  "ebiggers@...nel.org"
 <ebiggers@...nel.org>, Randy Dunlap <rdunlap@...radead.org>, open list
 <linux-kernel@...r.kernel.org>, "keyrings@...r.kernel.org"
 <keyrings@...r.kernel.org>, "linux-crypto@...r.kernel.org"
 <linux-crypto@...r.kernel.org>, "linux-efi@...r.kernel.org"
 <linux-efi@...r.kernel.org>, "linux-integrity@...r.kernel.org"
 <linux-integrity@...r.kernel.org>
Subject: Re: [RFC PATCH v3 03/13] clavis: Introduce a new system keyring
 called clavis

On Thu, 2024-10-17 at 20:34 +0000, Eric Snowberg wrote:
> 
> 
> > On Oct 17, 2024, at 10:50 AM, Jarkko Sakkinen <jarkko@...nel.org>
> > wrote:
> > 
> > On Thu, 2024-10-17 at 09:55 -0600, Eric Snowberg wrote:
> > > +static struct asymmetric_key_id *clavis_parse_boot_param(char
> > > *kid,
> > > struct asymmetric_key_id *akid,
> > > + int
> > > akid_max_len)
> > > +{
> > > + int error, hex_len;
> > > +
> > > + if (!kid)
> > > + return 0;
> > > +
> > > + hex_len = strlen(kid) / 2;
> > 
> > Hmmm... I'd consider sanity checking this:
> > 
> > size_t len;
> > 
> > /* ... */
> > 
> > len = strlen(kid);
> > if (len % 2) {
> > pr_err("Clavis key id has invalid length %lu\n", len);
> > return 0;
> > }
> > 
> > hex_len = len / 2;
> > 
> 
> Good catch, I will include this in the next round.  I have also added
> a kunit test 
> for this as well.  Thanks.

I guess hex2bin() would eventually catch this issue, i.e. not an actual
bug, but I still think that you are better off doing also check here and
get an appropriate message to klog if that ever happens :-)

BR, Jarkko