1 files changed, 26 insertions, 30 deletions

diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index eff88a5f5d40..4743d71e4aa6 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -26,6 +26,8 @@
 #include <asm/uaccess.h>
 #include "internal.h"
 
+#define KEY_MAX_DESC_SIZE 4096
+
 static int key_get_type_from_user(char *type,
                                   const char __user *_type,
                                   unsigned len)
@@ -78,7 +80,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
 
         description = NULL;
         if (_description) {
-                description = strndup_user(_description, PAGE_SIZE);
+                description = strndup_user(_description, KEY_MAX_DESC_SIZE);
                 if (IS_ERR(description)) {
                         ret = PTR_ERR(description);
                         goto error;
@@ -177,7 +179,7 @@ SYSCALL_DEFINE4(request_key, const char __user *, _type,
                 goto error;
 
         /* pull the description into kernel space */
-        description = strndup_user(_description, PAGE_SIZE);
+        description = strndup_user(_description, KEY_MAX_DESC_SIZE);
         if (IS_ERR(description)) {
                 ret = PTR_ERR(description);
                 goto error;
@@ -287,7 +289,7 @@ long keyctl_join_session_keyring(const char __user *_name)
         /* fetch the name from userspace */
         name = NULL;
         if (_name) {
-                name = strndup_user(_name, PAGE_SIZE);
+                name = strndup_user(_name, KEY_MAX_DESC_SIZE);
                 if (IS_ERR(name)) {
                         ret = PTR_ERR(name);
                         goto error;
@@ -562,8 +564,9 @@ long keyctl_describe_key(key_serial_t keyid,
 {
         struct key *key, *instkey;
         key_ref_t key_ref;
-        char *tmpbuf;
+        char *infobuf;
         long ret;
+        int desclen, infolen;
 
         key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_NEED_VIEW);
         if (IS_ERR(key_ref)) {
@@ -586,38 +589,31 @@ long keyctl_describe_key(key_serial_t keyid,
         }
 
 okay:
-        /* calculate how much description we're going to return */
-        ret = -ENOMEM;
-        tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!tmpbuf)
-                goto error2;
-
         key = key_ref_to_ptr(key_ref);
+        desclen = strlen(key->description);
 
-        ret = snprintf(tmpbuf, PAGE_SIZE - 1,
-                       "%s;%d;%d;%08x;%s",
-                       key->type->name,
-                       from_kuid_munged(current_user_ns(), key->uid),
-                       from_kgid_munged(current_user_ns(), key->gid),
-                       key->perm,
-                       key->description ?: "");
-
-        /* include a NUL char at the end of the data */
-        if (ret > PAGE_SIZE - 1)
-                ret = PAGE_SIZE - 1;
-        tmpbuf[ret] = 0;
-        ret++;
+        /* calculate how much information we're going to return */
+        ret = -ENOMEM;
+        infobuf = kasprintf(GFP_KERNEL,
+                            "%s;%d;%d;%08x;",
+                            key->type->name,
+                            from_kuid_munged(current_user_ns(), key->uid),
+                            from_kgid_munged(current_user_ns(), key->gid),
+                            key->perm);
+        if (!infobuf)
+                goto error2;
+        infolen = strlen(infobuf);
+        ret = infolen + desclen + 1;
 
         /* consider returning the data */
-        if (buffer && buflen > 0) {
-                if (buflen > ret)
-                        buflen = ret;
-
-                if (copy_to_user(buffer, tmpbuf, buflen) != 0)
+        if (buffer && buflen >= ret) {
+                if (copy_to_user(buffer, infobuf, infolen) != 0 ||
+                    copy_to_user(buffer + infolen, key->description,
+                                 desclen + 1) != 0)
                         ret = -EFAULT;
         }
 
-        kfree(tmpbuf);
+        kfree(infobuf);
 error2:
         key_ref_put(key_ref);
 error:
@@ -649,7 +645,7 @@ long keyctl_keyring_search(key_serial_t ringid,
         if (ret < 0)
                 goto error;
 
-        description = strndup_user(_description, PAGE_SIZE);
+        description = strndup_user(_description, KEY_MAX_DESC_SIZE);
         if (IS_ERR(description)) {
                 ret = PTR_ERR(description);
                 goto error;