From 4a868ba092370908b438245b0060f1796cef7a9c Mon Sep 17 00:00:00 2001 From: Gaurav Kashyap Date: Mon, 8 Jun 2020 16:12:57 -0700 Subject: [PATCH] soc: qcom: hwkm: check key size before unwrap Make sure key size is what is expected by command packet for KEY_UNWRAP_IMPORT in order to not overflow the buffer and corrupt the stack. Change-Id: Iba1d6bb3bf5efc4f4e64dafce0fbb65bb6f7b8c6 Signed-off-by: Gaurav Kashyap --- drivers/soc/qcom/hwkm.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/drivers/soc/qcom/hwkm.c b/drivers/soc/qcom/hwkm.c index 7be30ef3834e..b0566c176550 100644 --- a/drivers/soc/qcom/hwkm.c +++ b/drivers/soc/qcom/hwkm.c @@ -44,6 +44,8 @@ int retries; #define WAIT_UNTIL(cond) \ for (retries = 0; !(cond) && (retries < MAX_RETRIES); retries++) +#define EXPECTED_UNWRAP_KEY_SIZE 68 + #define ICEMEM_SLAVE_TPKEY_VAL 0x192 #define ICEMEM_SLAVE_TPKEY_SLOT 0x92 #define KM_MASTER_TPKEY_SLOT 10 @@ -473,6 +475,12 @@ static int qti_handle_key_unwrap_import(const struct hwkm_cmd *cmd_in, pr_debug("%s: KEY_UNWRAP_IMPORT start\n", __func__); + if (cmd_in->unwrap.sz != EXPECTED_UNWRAP_KEY_SIZE) { + pr_err("%s: Invalid key size - %d\n", __func__, + cmd_in->unwrap.sz); + return -EINVAL; + } + memcpy(cmd, &operation, OPERATION_INFO_LENGTH); memcpy(cmd + COMMAND_WRAPPED_KEY_IDX, cmd_in->unwrap.wkb, cmd_in->unwrap.sz);