1 files changed, 23 insertions, 4 deletions

diff --git a/net/rxrpc/ar-key.c b/net/rxrpc/ar-key.c
index 5ee16f0353fe..43ea7de2fc8e 100644
--- a/net/rxrpc/ar-key.c
+++ b/net/rxrpc/ar-key.c
@@ -25,6 +25,7 @@
 #include <keys/user-type.h>
 #include "ar-internal.h"
 
+static int rxrpc_vet_description_s(const char *);
 static int rxrpc_instantiate(struct key *, const void *, size_t);
 static int rxrpc_instantiate_s(struct key *, const void *, size_t);
 static void rxrpc_destroy(struct key *);
@@ -52,6 +53,7 @@ EXPORT_SYMBOL(key_type_rxrpc);
  */
 struct key_type key_type_rxrpc_s = {
         .name           = "rxrpc_s",
+        .vet_description = rxrpc_vet_description_s,
         .instantiate    = rxrpc_instantiate_s,
         .match          = user_match,
         .destroy        = rxrpc_destroy_s,
@@ -59,6 +61,23 @@ struct key_type key_type_rxrpc_s = {
 };
 
 /*
+ * Vet the description for an RxRPC server key
+ */
+static int rxrpc_vet_description_s(const char *desc)
+{
+        unsigned long num;
+        char *p;
+
+        num = simple_strtoul(desc, &p, 10);
+        if (*p != ':' || num > 65535)
+                return -EINVAL;
+        num = simple_strtoul(p + 1, &p, 10);
+        if (*p || num < 1 || num > 255)
+                return -EINVAL;
+        return 0;
+}
+
+/*
  * parse an RxKAD type XDR format token
  * - the caller guarantees we have at least 4 words
  */
@@ -89,11 +108,11 @@ static int rxrpc_instantiate_xdr_rxkad(struct key *key, const __be32 *xdr,
                 return ret;
 
         plen -= sizeof(*token);
-        token = kmalloc(sizeof(*token), GFP_KERNEL);
+        token = kzalloc(sizeof(*token), GFP_KERNEL);
         if (!token)
                 return -ENOMEM;
 
-        token->kad = kmalloc(plen, GFP_KERNEL);
+        token->kad = kzalloc(plen, GFP_KERNEL);
         if (!token->kad) {
                 kfree(token);
                 return -ENOMEM;
@@ -731,10 +750,10 @@ static int rxrpc_instantiate(struct key *key, const void *data, size_t datalen)
                 goto error;
 
         ret = -ENOMEM;
-        token = kmalloc(sizeof(*token), GFP_KERNEL);
+        token = kzalloc(sizeof(*token), GFP_KERNEL);
         if (!token)
                 goto error;
-        token->kad = kmalloc(plen, GFP_KERNEL);
+        token->kad = kzalloc(plen, GFP_KERNEL);
         if (!token->kad)
                 goto error_free;