5 files changed, 64 insertions, 23 deletions

diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index 933623784ccd..2806e70d7f8f 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -22,6 +22,7 @@
 #include <keys/user-type.h>
 #include <keys/big_key-type.h>
 #include <crypto/aead.h>
+#include <crypto/gcm.h>
 
 struct big_key_buf {
         unsigned int            nr_pages;
@@ -85,6 +86,7 @@ struct key_type key_type_big_key = {
  * Crypto names for big_key data authenticated encryption
  */
 static const char big_key_alg_name[] = "gcm(aes)";
+#define BIG_KEY_IV_SIZE         GCM_AES_IV_SIZE
 
 /*
  * Crypto algorithms for big_key data authenticated encryption
@@ -109,7 +111,7 @@ static int big_key_crypt(enum big_key_op op, struct big_key_buf *buf, size_t dat
          * an .update function, so there's no chance we'll wind up reusing the
          * key to encrypt updated data. Simply put: one key, one encryption.
          */
-        u8 zero_nonce[crypto_aead_ivsize(big_key_aead)];
+        u8 zero_nonce[BIG_KEY_IV_SIZE];
 
         aead_req = aead_request_alloc(big_key_aead, GFP_KERNEL);
         if (!aead_req)
@@ -425,6 +427,13 @@ static int __init big_key_init(void)
                 pr_err("Can't alloc crypto: %d\n", ret);
                 return ret;
         }
+
+        if (unlikely(crypto_aead_ivsize(big_key_aead) != BIG_KEY_IV_SIZE)) {
+                WARN(1, "big key algorithm changed?");
+                ret = -EINVAL;
+                goto free_aead;
+        }
+
         ret = crypto_aead_setauthsize(big_key_aead, ENC_AUTHTAG_SIZE);
         if (ret < 0) {
                 pr_err("Can't set crypto auth tag len: %d\n", ret);
diff --git a/security/keys/dh.c b/security/keys/dh.c
index d1ea9f325f94..f7403821db7f 100644
--- a/security/keys/dh.c
+++ b/security/keys/dh.c
@@ -162,8 +162,8 @@ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
                         goto err;
 
                 if (zlen && h) {
-                        u8 tmpbuffer[h];
-                        size_t chunk = min_t(size_t, zlen, h);
+                        u8 tmpbuffer[32];
+                        size_t chunk = min_t(size_t, zlen, sizeof(tmpbuffer));
                         memset(tmpbuffer, 0, chunk);
 
                         do {
@@ -173,7 +173,7 @@ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
                                         goto err;
 
                                 zlen -= chunk;
-                                chunk = min_t(size_t, zlen, h);
+                                chunk = min_t(size_t, zlen, sizeof(tmpbuffer));
                         } while (zlen);
                 }
 
@@ -183,24 +183,13 @@ static int kdf_ctr(struct kdf_sdesc *sdesc, const u8 *src, unsigned int slen,
                                 goto err;
                 }
 
-                if (dlen < h) {
-                        u8 tmpbuffer[h];
-
-                        err = crypto_shash_final(desc, tmpbuffer);
-                        if (err)
-                                goto err;
-                        memcpy(dst, tmpbuffer, dlen);
-                        memzero_explicit(tmpbuffer, h);
-                        return 0;
-                } else {
-                        err = crypto_shash_final(desc, dst);
-                        if (err)
-                                goto err;
+                err = crypto_shash_final(desc, dst);
+                if (err)
+                        goto err;
 
-                        dlen -= h;
-                        dst += h;
-                        counter = cpu_to_be32(be32_to_cpu(counter) + 1);
-                }
+                dlen -= h;
+                dst += h;
+                counter = cpu_to_be32(be32_to_cpu(counter) + 1);
         }
 
         return 0;
@@ -216,14 +205,16 @@ static int keyctl_dh_compute_kdf(struct kdf_sdesc *sdesc,
 {
         uint8_t *outbuf = NULL;
         int ret;
+        size_t outbuf_len = round_up(buflen,
+                                     crypto_shash_digestsize(sdesc->shash.tfm));
 
-        outbuf = kmalloc(buflen, GFP_KERNEL);
+        outbuf = kmalloc(outbuf_len, GFP_KERNEL);
         if (!outbuf) {
                 ret = -ENOMEM;
                 goto err;
         }
 
-        ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, buflen, lzero);
+        ret = kdf_ctr(sdesc, kbuf, kbuflen, outbuf, outbuf_len, lzero);
         if (ret)
                 goto err;
 
diff --git a/security/security.c b/security/security.c
index 7bc2fde023a7..68f46d849abe 100644
--- a/security/security.c
+++ b/security/security.c
@@ -1358,6 +1358,12 @@ int security_socket_post_create(struct socket *sock, int family,
                                                 protocol, kern);
 }
 
+int security_socket_socketpair(struct socket *socka, struct socket *sockb)
+{
+        return call_int_hook(socket_socketpair, 0, socka, sockb);
+}
+EXPORT_SYMBOL(security_socket_socketpair);
+
 int security_socket_bind(struct socket *sock, struct sockaddr *address, int addrlen)
 {
         return call_int_hook(socket_bind, 0, sock, address, addrlen);
diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c
index 99c4675952f7..7df0f2ee1e88 100644
--- a/security/selinux/hooks.c
+++ b/security/selinux/hooks.c
@@ -4580,6 +4580,18 @@ static int selinux_socket_post_create(struct socket *sock, int family,
         return err;
 }
 
+static int selinux_socket_socketpair(struct socket *socka,
+                                     struct socket *sockb)
+{
+        struct sk_security_struct *sksec_a = socka->sk->sk_security;
+        struct sk_security_struct *sksec_b = sockb->sk->sk_security;
+
+        sksec_a->peer_sid = sksec_b->sid;
+        sksec_b->peer_sid = sksec_a->sid;
+
+        return 0;
+}
+
 /* Range of port numbers used to automatically bind.
    Need to determine whether we should perform a name_bind
    permission check between the socket and the port number. */
@@ -7016,6 +7028,7 @@ static struct security_hook_list selinux_hooks[] __lsm_ro_after_init = {
 
         LSM_HOOK_INIT(socket_create, selinux_socket_create),
         LSM_HOOK_INIT(socket_post_create, selinux_socket_post_create),
+        LSM_HOOK_INIT(socket_socketpair, selinux_socket_socketpair),
         LSM_HOOK_INIT(socket_bind, selinux_socket_bind),
         LSM_HOOK_INIT(socket_connect, selinux_socket_connect),
         LSM_HOOK_INIT(socket_listen, selinux_socket_listen),
diff --git a/security/smack/smack_lsm.c b/security/smack/smack_lsm.c
index 0b414836bebd..dcb976f98df2 100644
--- a/security/smack/smack_lsm.c
+++ b/security/smack/smack_lsm.c
@@ -2842,6 +2842,27 @@ static int smack_socket_post_create(struct socket *sock, int family,
         return smack_netlabel(sock->sk, SMACK_CIPSO_SOCKET);
 }
 
+/**
+ * smack_socket_socketpair - create socket pair
+ * @socka: one socket
+ * @sockb: another socket
+ *
+ * Cross reference the peer labels for SO_PEERSEC
+ *
+ * Returns 0 on success, and error code otherwise
+ */
+static int smack_socket_socketpair(struct socket *socka,
+                                   struct socket *sockb)
+{
+        struct socket_smack *asp = socka->sk->sk_security;
+        struct socket_smack *bsp = sockb->sk->sk_security;
+
+        asp->smk_packet = bsp->smk_out;
+        bsp->smk_packet = asp->smk_out;
+
+        return 0;
+}
+
 #ifdef SMACK_IPV6_PORT_LABELING
 /**
  * smack_socket_bind - record port binding information.
@@ -4724,6 +4745,7 @@ static struct security_hook_list smack_hooks[] __lsm_ro_after_init = {
         LSM_HOOK_INIT(unix_may_send, smack_unix_may_send),
 
         LSM_HOOK_INIT(socket_post_create, smack_socket_post_create),
+        LSM_HOOK_INIT(socket_socketpair, smack_socket_socketpair),
 #ifdef SMACK_IPV6_PORT_LABELING
         LSM_HOOK_INIT(socket_bind, smack_socket_bind),
 #endif