5 files changed, 47 insertions, 15 deletions

diff --git a/drivers/target/target_core_fabric_lib.c b/drivers/target/target_core_fabric_lib.c
index c4ea3a9a555b..39f021b855ef 100644
--- a/drivers/target/target_core_fabric_lib.c
+++ b/drivers/target/target_core_fabric_lib.c
@@ -63,6 +63,7 @@ u32 sas_get_pr_transport_id(
         unsigned char *buf)
 {
         unsigned char *ptr;
+        int ret;
 
         /*
          * Set PROTOCOL IDENTIFIER to 6h for SAS
@@ -74,7 +75,9 @@ u32 sas_get_pr_transport_id(
          */
         ptr = &se_nacl->initiatorname[4]; /* Skip over 'naa. prefix */
 
-        hex2bin(&buf[4], ptr, 8);
+        ret = hex2bin(&buf[4], ptr, 8);
+        if (ret < 0)
+                pr_debug("sas transport_id: invalid hex string\n");
 
         /*
          * The SAS Transport ID is a hardcoded 24-byte length
@@ -156,8 +159,9 @@ u32 fc_get_pr_transport_id(
         unsigned char *buf)
 {
         unsigned char *ptr;
-        int i;
+        int i, ret;
         u32 off = 8;
+
         /*
          * PROTOCOL IDENTIFIER is 0h for FCP-2
          *
@@ -174,7 +178,9 @@ u32 fc_get_pr_transport_id(
                         i++;
                         continue;
                 }
-                hex2bin(&buf[off++], &ptr[i], 1);
+                ret = hex2bin(&buf[off++], &ptr[i], 1);
+                if (ret < 0)
+                        pr_debug("fc transport_id: invalid hex string\n");
                 i += 2;
         }
         /*
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 46ac9a50528d..8eefcf7e95eb 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -382,7 +382,7 @@ static inline char *pack_hex_byte(char *buf, u8 byte)
 }
 
 extern int hex_to_bin(char ch);
-extern void hex2bin(u8 *dst, const char *src, size_t count);
+extern int __must_check hex2bin(u8 *dst, const char *src, size_t count);
 
 /*
  * General tracing related utility functions - trace_printk(),
diff --git a/lib/hexdump.c b/lib/hexdump.c
index f5fe6ba7a3ab..51d5ae210244 100644
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
@@ -38,14 +38,21 @@ EXPORT_SYMBOL(hex_to_bin);
  * @dst: binary result
  * @src: ascii hexadecimal string
  * @count: result length
+ *
+ * Return 0 on success, -1 in case of bad input.
  */
-void hex2bin(u8 *dst, const char *src, size_t count)
+int hex2bin(u8 *dst, const char *src, size_t count)
 {
         while (count--) {
-                *dst = hex_to_bin(*src++) << 4;
-                *dst += hex_to_bin(*src++);
-                dst++;
+                int hi = hex_to_bin(*src++);
+                int lo = hex_to_bin(*src++);
+
+                if ((hi < 0) || (lo < 0))
+                        return -1;
+
+                *dst++ = (hi << 4) | lo;
         }
+        return 0;
 }
 EXPORT_SYMBOL(hex2bin);
 
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 3f577954b85a..f33804c1b4c8 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -667,11 +667,19 @@ static int encrypted_key_decrypt(struct encrypted_key_payload *epayload,
                 return -EINVAL;
 
         hex_encoded_data = hex_encoded_iv + (2 * ivsize) + 2;
-        hex2bin(epayload->iv, hex_encoded_iv, ivsize);
-        hex2bin(epayload->encrypted_data, hex_encoded_data, encrypted_datalen);
+        ret = hex2bin(epayload->iv, hex_encoded_iv, ivsize);
+        if (ret < 0)
+                return -EINVAL;
+        ret = hex2bin(epayload->encrypted_data, hex_encoded_data,
+                      encrypted_datalen);
+        if (ret < 0)
+                return -EINVAL;
 
         hmac = epayload->format + epayload->datablob_len;
-        hex2bin(hmac, hex_encoded_data + (encrypted_datalen * 2), HASH_SIZE);
+        ret = hex2bin(hmac, hex_encoded_data + (encrypted_datalen * 2),
+                      HASH_SIZE);
+        if (ret < 0)
+                return -EINVAL;
 
         mkey = request_master_key(epayload, &master_key, &master_keylen);
         if (IS_ERR(mkey))
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 0c33e2ea1f3c..0964fc236946 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -779,7 +779,10 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
                         opt->pcrinfo_len = strlen(args[0].from) / 2;
                         if (opt->pcrinfo_len > MAX_PCRINFO_SIZE)
                                 return -EINVAL;
-                        hex2bin(opt->pcrinfo, args[0].from, opt->pcrinfo_len);
+                        res = hex2bin(opt->pcrinfo, args[0].from,
+                                      opt->pcrinfo_len);
+                        if (res < 0)
+                                return -EINVAL;
                         break;
                 case Opt_keyhandle:
                         res = strict_strtoul(args[0].from, 16, &handle);
@@ -791,12 +794,18 @@ static int getoptions(char *c, struct trusted_key_payload *pay,
                 case Opt_keyauth:
                         if (strlen(args[0].from) != 2 * SHA1_DIGEST_SIZE)
                                 return -EINVAL;
-                        hex2bin(opt->keyauth, args[0].from, SHA1_DIGEST_SIZE);
+                        res = hex2bin(opt->keyauth, args[0].from,
+                                      SHA1_DIGEST_SIZE);
+                        if (res < 0)
+                                return -EINVAL;
                         break;
                 case Opt_blobauth:
                         if (strlen(args[0].from) != 2 * SHA1_DIGEST_SIZE)
                                 return -EINVAL;
-                        hex2bin(opt->blobauth, args[0].from, SHA1_DIGEST_SIZE);
+                        res = hex2bin(opt->blobauth, args[0].from,
+                                      SHA1_DIGEST_SIZE);
+                        if (res < 0)
+                                return -EINVAL;
                         break;
                 case Opt_migratable:
                         if (*args[0].from == '0')
@@ -860,7 +869,9 @@ static int datablob_parse(char *datablob, struct trusted_key_payload *p,
                 p->blob_len = strlen(c) / 2;
                 if (p->blob_len > MAX_BLOB_SIZE)
                         return -EINVAL;
-                hex2bin(p->blob, c, p->blob_len);
+                ret = hex2bin(p->blob, c, p->blob_len);
+                if (ret < 0)
+                        return -EINVAL;
                 ret = getoptions(datablob, p, o);
                 if (ret < 0)
                         return ret;