• Home
  • Line#
  • Scopes#
  • Navigate#
  • Raw
  • Download
1 /*
2  * Check decoding of keyctl syscall.
3  *
4  * Copyright (c) 2016 Eugene Syromyatnikov <evgsyr@gmail.com>
5  * Copyright (c) 2016-2017 The strace developers.
6  * All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. The name of the author may not be used to endorse or promote products
17  *    derived from this software without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE AUTHOR ``AS IS'' AND ANY EXPRESS OR
20  * IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES
21  * OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
22  * IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR ANY DIRECT, INDIRECT,
23  * INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
24  * NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
25  * DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
26  * THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
27  * (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
28  * THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
29  */
30 
31 #include "tests.h"
32 
33 #include <asm/unistd.h>
34 
35 #ifdef __NR_keyctl
36 
37 # include <linux/types.h>
38 # include <linux/keyctl.h>
39 
40 # include <assert.h>
41 # include <errno.h>
42 # include <inttypes.h>
43 # include <stdarg.h>
44 # include <stdbool.h>
45 # include <stdio.h>
46 # include <stdlib.h>
47 # include <string.h>
48 # include <unistd.h>
49 # include <sys/uio.h>
50 
51 /* This check should be before #include "xlat/keyctl_commands.h" */
52 # ifndef KEYCTL_DH_COMPUTE
53 struct keyctl_dh_params {
54 	int32_t private;
55 	int32_t prime;
56 	int32_t base;
57 };
58 # endif
59 
60 # ifndef HAVE_STRUCT_KEYCTL_KDF_PARAMS
61 struct keyctl_kdf_params {
62 	char *hashname;
63 	char *otherinfo;
64 	uint32_t otherinfolen;
65 	uint32_t __spare[8];
66 };
67 # endif
68 
69 # include "xlat.h"
70 # include "xlat/keyctl_commands.h"
71 
72 # ifndef KEY_SPEC_REQKEY_AUTH_KEY
73 #  define KEY_SPEC_REQKEY_AUTH_KEY   -7
74 # endif
75 
76 # ifndef KEY_SPEC_REQUESTOR_KEYRING
77 #  define KEY_SPEC_REQUESTOR_KEYRING -8
78 # endif
79 
80 static const size_t limit = 10;
81 
82 /*
83  * Well, this is true for DESCRIBE and GET_SECURITY, and false for READ and
84  * DH_COMPUTE and I see no ability to pass this information without
85  * significantly breaking interface.
86  */
87 bool nul_terminated_buf = true;
88 bool buf_in_arg;
89 
90 /* From ioctl_dm.c */
91 # define STR32 "AbCdEfGhIjKlMnOpQrStUvWxYz012345"
92 
93 /*
94  * When this is called with positive size, the buffer provided is an "out"
95  * argument and rc contains resulting size (globally defined nul_terminated_buf
96  * controls whether it is nul-terminated or not). If size is negative,
97  * it contains "in" argument.
98  */
99 void
print_quoted_string_limit(const char * str,size_t size,long rc)100 print_quoted_string_limit(const char *str, size_t size, long rc)
101 {
102 	size_t print_size = ((rc >= 0) && (size > 0)) ?
103 		((unsigned long) rc > size ? size :
104 		(unsigned long) rc) : size;
105 	size_t limited_size = print_size > limit ? limit : print_size;
106 
107 	if ((rc == -1) && !buf_in_arg) {
108 		printf("%p", str);
109 		return;
110 	}
111 
112 	if (!nul_terminated_buf ||
113 	    (strnlen(str, limited_size) == limited_size)) {
114 		print_quoted_memory(str, limited_size);
115 		if (print_size > limit)
116 			printf("...");
117 	} else
118 		print_quoted_string(str);
119 }
120 
121 static void
print_arg(kernel_ulong_t arg,const char * str,const char * fmt,size_t size,long rc)122 print_arg(kernel_ulong_t arg, const char *str, const char *fmt, size_t size,
123 	long rc)
124 {
125 	if (size == (size_t) -1)
126 		size = 0;
127 
128 	if (str) {
129 		printf("%s", str);
130 	} else {
131 		if (size == sizeof(uint64_t))
132 			printf(fmt, (uint64_t) arg);
133 		else if (size == sizeof(uint32_t))
134 			printf(fmt, (uint32_t) arg);
135 		else
136 			print_quoted_string_limit((void *) (uintptr_t) arg,
137 						  size, rc);
138 	}
139 }
140 
141 /*
142  * Arguments are passed as sz, val, str, fmt. Arguments are read until 4
143  * arguments are retrieved or size of 0 is occurred.
144  *
145  * str == NULL && fmt == NULL && sz not in {4, 8} - print_quoted_string_limit is
146  *   used for argument printing. If sz is negative, in argument is assumed, out
147  *   otherwise.
148  */
149 void
do_keyctl(kernel_ulong_t cmd,const char * cmd_str,...)150 do_keyctl(kernel_ulong_t cmd, const char *cmd_str, ...)
151 {
152 	kernel_ulong_t args[4] = {
153 		(kernel_ulong_t) 0xdeadfee1badc0de5ULL,
154 		(kernel_ulong_t) 0xdeadfee2badc0de6ULL,
155 		(kernel_ulong_t) 0xdeadfee3badc0de7ULL,
156 		(kernel_ulong_t) 0xdeadfee4badc0de8ULL,
157 	};
158 	const char *arg_str[4] = { NULL };
159 	const char *arg_fmt[4] = { "%llu", "%llu", "%llu", "%llu" };
160 	size_t arg_sz[4] = {
161 		sizeof(kernel_ulong_t),
162 		sizeof(kernel_ulong_t),
163 		sizeof(kernel_ulong_t),
164 		sizeof(kernel_ulong_t),
165 	};
166 	unsigned i;
167 	unsigned cnt = 0;
168 
169 	va_list ap;
170 
171 	va_start(ap, cmd_str);
172 
173 	do {
174 		arg_sz[cnt] = va_arg(ap, size_t);
175 		if (!arg_sz[cnt])
176 			break;
177 
178 		if (arg_sz[cnt] == sizeof(uint64_t))
179 			args[cnt] = va_arg(ap, uint64_t);
180 		else if (arg_sz[cnt] == sizeof(uint32_t))
181 			args[cnt] = va_arg(ap, uint32_t);
182 		else
183 			args[cnt] = (uintptr_t) va_arg(ap, void *);
184 
185 		arg_str[cnt] = va_arg(ap, char *);
186 		arg_fmt[cnt] = va_arg(ap, char *);
187 	} while (++cnt < 4);
188 
189 	long rc = syscall(__NR_keyctl, cmd, args[0], args[1], args[2], args[3]);
190 	const char *errstr = sprintrc(rc);
191 	printf("keyctl(%s", cmd_str);
192 	for (i = 0; i < cnt; i++) {
193 		printf(", ");
194 		print_arg(args[i], arg_str[i], arg_fmt[i], arg_sz[i], rc);
195 	}
196 	printf(") = %s\n", errstr);
197 }
198 
199 int
append_str(char ** buf,size_t * left,const char * fmt,...)200 append_str(char **buf, size_t *left, const char *fmt, ...)
201 {
202 	int ret;
203 	va_list ap;
204 
205 	va_start(ap, fmt);
206 	ret = vsnprintf(*buf, *left, fmt, ap);
207 	va_end(ap);
208 
209 	assert((ret >= 0) && ((unsigned) ret < *left));
210 
211 	*left -= ret;
212 	*buf += ret;
213 
214 	return ret;
215 }
216 
217 const char *
kckdfp_to_str(struct keyctl_kdf_params * kdf,bool deref_hash,bool deref_oi,bool print_spare,const char * hash_str,const char * oi_str)218 kckdfp_to_str(struct keyctl_kdf_params *kdf, bool deref_hash, bool deref_oi,
219 	       bool print_spare, const char *hash_str, const char *oi_str)
220 {
221 	static char buf[4096];
222 
223 	size_t left = sizeof(buf);
224 	char *pos = buf;
225 
226 	append_str(&pos, &left, "{hashname=");
227 
228 	if (deref_hash && hash_str) {
229 		append_str(&pos, &left, "%s", hash_str);
230 	} else if (!kdf->hashname) {
231 		append_str(&pos, &left, "NULL");
232 	} else if (deref_hash) {
233 		append_str(&pos, &left, "\"%.*s\"", limit, kdf->hashname);
234 
235 		if (strnlen(kdf->hashname, limit + 1) > limit)
236 			append_str(&pos, &left, "...");
237 	} else {
238 		append_str(&pos, &left, "%p", kdf->hashname);
239 	}
240 
241 	append_str(&pos, &left, ", otherinfo=");
242 
243 	if (deref_oi && oi_str) {
244 		append_str(&pos, &left, "%s", oi_str);
245 	} else if (!kdf->otherinfo) {
246 		append_str(&pos, &left, "NULL");
247 	} else if (deref_oi) {
248 		append_str(&pos, &left, "\"%.*s\"", limit, kdf->otherinfo);
249 
250 		if (strnlen(kdf->otherinfo, limit + 1) > limit)
251 			append_str(&pos, &left, "...");
252 	} else {
253 		append_str(&pos, &left, "%p", kdf->otherinfo);
254 	}
255 
256 	append_str(&pos, &left, ", otherinfolen=%u", kdf->otherinfolen);
257 
258 	if (print_spare) {
259 		size_t i;
260 
261 		append_str(&pos, &left, ", __spare=[");
262 
263 		for (i = 0; i < ARRAY_SIZE(kdf->__spare); i++) {
264 			if  (i)
265 				append_str(&pos, &left, ", ");
266 
267 			append_str(&pos, &left, "%#x", kdf->__spare[i]);
268 		}
269 
270 		append_str(&pos, &left, "]");
271 	}
272 
273 	append_str(&pos, &left, "}");
274 
275 	return buf;
276 }
277 
278 int
main(void)279 main(void)
280 {
281 	enum { PR_LIMIT = 10, IOV_SIZE = 11, IOV_STR_SIZE = 4096 };
282 
283 	static const char *kulong_fmt =
284 		sizeof(kernel_ulong_t) == sizeof(uint64_t) ? "%#llx" : "%#x";
285 	static const char *ksize_fmt =
286 		sizeof(kernel_ulong_t) == sizeof(uint64_t) ? "%llu" : "%u";
287 	static const char *ptr_fmt =
288 		sizeof(void *) == sizeof(uint64_t) ? "%#llx" : "%#x";
289 	static const char unterminated1[] = { '\1', '\2', '\3', '\4', '\5' };
290 	static const char unterminated2[] = { '\6', '\7', '\10', '\11', '\12' };
291 	static const char short_type_str[] = "shrt type";
292 	static const char short_desc_str[] = "shrt desc";
293 	static const char long_type_str[] = "overly long key type";
294 	static const char long_desc_str[] = "overly long key description";
295 	static const int32_t bogus_key1 = 0xdeadf00d;
296 	static const int32_t bogus_key2 = 0x1eefdead;
297 	static const kernel_ulong_t bogus_key3 =
298 		(kernel_ulong_t) 0xdec0ded1dec0ded2ULL;
299 	static const char *bogus_key3_str = "-557785390";
300 
301 	static const struct keyctl_dh_params kcdhp_data = {
302 		KEY_SPEC_GROUP_KEYRING, 1234567890, 3141592653U };
303 	static const char *kcdhp_str = "{private=KEY_SPEC_GROUP_KEYRING, "
304 		"prime=1234567890, base=-1153374643}";
305 
306 	/*
307 	 * It's bigger than current hash name size limit, but since it's
308 	 * implementation-dependent and totally internal, we do not rely
309 	 * on it much.
310 	 */
311 	static const char long_hash_data[] = STR32 STR32 STR32 STR32 "xxx";
312 	static const char short_hash_data[] = "hmac(aes)";
313 	static const char otherinfo1_data[] = "\1\2 OH HAI THAR\255\0\1";
314 	static const char otherinfo2_data[] = "\1\2\n\255\0\1";
315 	static const struct keyctl_kdf_params kckdfp_data[] = {
316 		[0] = { NULL, NULL, 0, { 0 } },
317 		[1] = { NULL /* Changed to unaccessible address in copy */,
318 			NULL, 0xbadc0dedU, { [7] = 0xdeadfeedU } },
319 		[2] = { NULL /* long_hash_data */,
320 			NULL /* Changed to unaccessible address in copy */,
321 			0, { 0 } },
322 		[3] = { NULL /* unterminated1 */,
323 			NULL /* otherinfo_data */, 0, { 1 } },
324 		[4] = { NULL /* short_hash_data */,
325 			NULL /* otherinfo1_data */, sizeof(otherinfo1_data),
326 			{ 0, 0xfacebeef, 0, 0xba5e1ead } },
327 		[5] = { NULL /* short_hash_data */,
328 			NULL /* otherinfo2_data */, sizeof(otherinfo2_data),
329 			{ 0 } },
330 	};
331 
332 	char *bogus_str = tail_memdup(unterminated1, sizeof(unterminated1));
333 	char *bogus_desc = tail_memdup(unterminated2, sizeof(unterminated2));
334 	char *short_type = tail_memdup(short_type_str, sizeof(short_type_str));
335 	char *short_desc = tail_memdup(short_desc_str, sizeof(short_desc_str));
336 	char *long_type = tail_memdup(long_type_str, sizeof(long_type_str));
337 	char *long_desc = tail_memdup(long_desc_str, sizeof(long_desc_str));
338 	char *kcdhp = tail_memdup(&kcdhp_data, sizeof(kcdhp_data));
339 	char *kckdfp_long_hash = tail_memdup(long_hash_data,
340 					     sizeof(long_hash_data));
341 	char *kckdfp_short_hash = tail_memdup(short_hash_data,
342 					      sizeof(short_hash_data));
343 	char *kckdfp_otherinfo1 = tail_memdup(otherinfo1_data,
344 					      sizeof(otherinfo1_data));
345 	char *kckdfp_otherinfo2 = tail_memdup(otherinfo2_data,
346 					      sizeof(otherinfo2_data));
347 	char *kckdfp_char = tail_alloc(sizeof(kckdfp_data[0]));
348 	struct iovec *key_iov = tail_alloc(sizeof(*key_iov) * IOV_SIZE);
349 	char *bogus_buf1 = tail_alloc(9);
350 	char *bogus_buf2 = tail_alloc(256);
351 	char *key_iov_str1;
352 	char *key_iov_str2 = tail_alloc(4096);
353 	ssize_t ret;
354 	ssize_t kis_size = 0;
355 	size_t i;
356 
357 	key_iov[0].iov_base = short_type;
358 	key_iov[0].iov_len = sizeof(short_type_str);
359 	key_iov[1].iov_base = long_type;
360 	key_iov[1].iov_len = sizeof(long_type_str);
361 	key_iov[2].iov_base = short_desc;
362 	key_iov[2].iov_len = sizeof(short_desc_str);
363 	key_iov[3].iov_base = long_desc;
364 	key_iov[3].iov_len = sizeof(long_desc_str);
365 	key_iov[4].iov_base = bogus_str;
366 	key_iov[4].iov_len = 32;
367 
368 	for (i = 5; i < IOV_SIZE; i++) {
369 		key_iov[i].iov_base =
370 			(void *) (uintptr_t) (0xfffffacefffff00dULL +
371 			0x100000001ULL * i);
372 		key_iov[i].iov_len = (size_t) (0xcaffeeeddefaced7ULL +
373 			0x100000001ULL * i);
374 	}
375 
376 	ret = asprintf(&key_iov_str1, "[{iov_base=%p, iov_len=%zu}, "
377 		       "{iov_base=%p, iov_len=%zu}, "
378 		       "{iov_base=%p, iov_len=%zu}, "
379 		       "{iov_base=%p, iov_len=%zu}]",
380 		       key_iov[IOV_SIZE - 4].iov_base,
381 		       key_iov[IOV_SIZE - 4].iov_len,
382 		       key_iov[IOV_SIZE - 3].iov_base,
383 		       key_iov[IOV_SIZE - 3].iov_len,
384 		       key_iov[IOV_SIZE - 2].iov_base,
385 		       key_iov[IOV_SIZE - 2].iov_len,
386 		       key_iov[IOV_SIZE - 1].iov_base,
387 		       key_iov[IOV_SIZE - 1].iov_len);
388 
389 	if (ret < 0)
390 		error_msg_and_fail("asprintf");
391 
392 	ret = snprintf(key_iov_str2, IOV_STR_SIZE,
393 		       "[{iov_base=\"%s\\0\", iov_len=%zu}, "
394 		       "{iov_base=\"%.10s\"..., iov_len=%zu}, "
395 		       "{iov_base=\"%s\\0\", iov_len=%zu}, "
396 		       "{iov_base=\"%.10s\"..., iov_len=%zu}, ",
397 		       (char *) key_iov[0].iov_base, key_iov[0].iov_len,
398 		       (char *) key_iov[1].iov_base, key_iov[1].iov_len,
399 		       (char *) key_iov[2].iov_base, key_iov[2].iov_len,
400 		       (char *) key_iov[3].iov_base, key_iov[3].iov_len);
401 
402 	if ((ret < 0) || (ret >= IOV_STR_SIZE))
403 		error_msg_and_fail("snprintf");
404 
405 	for (i = 4; i < PR_LIMIT; i++) {
406 		kis_size += ret;
407 
408 		ret = snprintf(key_iov_str2 + kis_size, IOV_STR_SIZE - kis_size,
409 			       "{iov_base=%p, iov_len=%zu}, ",
410 			       key_iov[i].iov_base, key_iov[i].iov_len);
411 
412 		if ((ret < 0) || (ret >= (IOV_STR_SIZE - kis_size)))
413 			error_msg_and_fail("snprintf");
414 	}
415 
416 	kis_size += ret;
417 	snprintf(key_iov_str2 + kis_size, IOV_STR_SIZE - kis_size, "...]");
418 
419 
420 	/* Invalid command */
421 	do_keyctl((kernel_ulong_t) 0xbadc0dedfacefeedULL,
422 		  "0xfacefeed /* KEYCTL_??? */",
423 		  sizeof(kernel_ulong_t),
424 			(kernel_ulong_t) 0xdeadfee1badc0de5ULL, NULL,
425 			kulong_fmt,
426 		  sizeof(kernel_ulong_t),
427 			(kernel_ulong_t) 0xdeadfee2badc0de6ULL, NULL,
428 			kulong_fmt,
429 		  sizeof(kernel_ulong_t),
430 			(kernel_ulong_t) 0xdeadfee3badc0de7ULL, NULL,
431 			kulong_fmt,
432 		  sizeof(kernel_ulong_t),
433 			(kernel_ulong_t) 0xdeadfee4badc0de8ULL, NULL,
434 			kulong_fmt);
435 
436 
437 	/* GET_KEYRING_ID */
438 	do_keyctl(ARG_STR(KEYCTL_GET_KEYRING_ID),
439 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
440 		  sizeof(kernel_ulong_t),
441 			(kernel_ulong_t) 0xbadc0dedffffffffLLU, "-1", NULL,
442 		  0UL);
443 	do_keyctl(ARG_STR(KEYCTL_GET_KEYRING_ID),
444 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), "%d",
445 		  sizeof(int), 3141592653U, NULL, "%d", NULL,
446 		  0UL);
447 
448 
449 	/* KEYCTL_JOIN_SESSION_KEYRING */
450 	do_keyctl(ARG_STR(KEYCTL_JOIN_SESSION_KEYRING),
451 		  sizeof(char *), ARG_STR(NULL), NULL,
452 		  0UL);
453 	do_keyctl(ARG_STR(KEYCTL_JOIN_SESSION_KEYRING),
454 		  sizeof(char *), (char *) 0xfffffacefffffeedULL, NULL, ptr_fmt,
455 		  0UL);
456 	do_keyctl(ARG_STR(KEYCTL_JOIN_SESSION_KEYRING),
457 		  sizeof(char *), bogus_str, NULL, ptr_fmt,
458 		  0UL);
459 	do_keyctl(ARG_STR(KEYCTL_JOIN_SESSION_KEYRING),
460 		  sizeof(char *), ARG_STR("bogus name"), NULL,
461 		  0UL);
462 	do_keyctl(ARG_STR(KEYCTL_JOIN_SESSION_KEYRING),
463 		  sizeof(char *), "very long keyring name", "\"very long \"...",
464 			NULL,
465 		  0UL);
466 
467 
468 	/* KEYCTL_UPDATE */
469 
470 	buf_in_arg = true;
471 
472 	do_keyctl(ARG_STR(KEYCTL_UPDATE),
473 		  sizeof(int32_t), ARG_STR(KEY_SPEC_REQUESTOR_KEYRING), NULL,
474 		  sizeof(char *), ARG_STR(NULL), NULL,
475 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 0, NULL, ksize_fmt,
476 		  0UL);
477 	do_keyctl(ARG_STR(KEYCTL_UPDATE),
478 		  sizeof(int32_t), bogus_key1, NULL, "%d",
479 		  sizeof(char *), (char *) 0xfffffacefffffeedULL, NULL, ptr_fmt,
480 		  sizeof(kernel_ulong_t),
481 			(kernel_ulong_t) 0xdeadfee4badc0de8ULL, NULL, ksize_fmt,
482 		  0UL);
483 	do_keyctl(ARG_STR(KEYCTL_UPDATE),
484 		  sizeof(int32_t), bogus_key2, NULL, "%d",
485 		  sizeof(char *), bogus_str, NULL, ptr_fmt,
486 		  sizeof(kernel_ulong_t),
487 			(kernel_ulong_t) 0xdeadfee4badc0de8ULL, NULL, ksize_fmt,
488 		  0UL);
489 	do_keyctl(ARG_STR(KEYCTL_UPDATE),
490 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
491 		  sizeof(short_desc_str), short_desc, NULL, NULL,
492 		  sizeof(kernel_ulong_t),
493 		  (kernel_ulong_t) sizeof(short_desc_str) - 1, NULL,
494 			  ksize_fmt,
495 		  0UL);
496 
497 	buf_in_arg = false;
498 
499 
500 	/* KEYCTL_REVOKE */
501 	do_keyctl(ARG_STR(KEYCTL_REVOKE),
502 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL,
503 		  0UL);
504 	do_keyctl(ARG_STR(KEYCTL_REVOKE),
505 		  sizeof(int32_t), bogus_key1, NULL, "%d",
506 		  0UL);
507 	do_keyctl(ARG_STR(KEYCTL_REVOKE),
508 		  sizeof(int32_t), bogus_key2, NULL, "%d",
509 		  0UL);
510 	do_keyctl(ARG_STR(KEYCTL_REVOKE),
511 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
512 		  0UL);
513 
514 
515 	/* KEYCTL_CHOWN */
516 	do_keyctl(ARG_STR(KEYCTL_CHOWN),
517 		  sizeof(int32_t), ARG_STR(KEY_SPEC_REQUESTOR_KEYRING), NULL,
518 		  sizeof(uid_t), ARG_STR(-1), NULL,
519 		  sizeof(gid_t), ARG_STR(-1), NULL,
520 		  0UL);
521 	do_keyctl(ARG_STR(KEYCTL_CHOWN),
522 		  sizeof(int32_t), bogus_key1, NULL, "%d",
523 		  sizeof(uid_t), 2718281828U, NULL, "%u",
524 		  sizeof(gid_t), 3141592653U, NULL, "%u",
525 		  0UL);
526 
527 
528 	/* KEYCTL_SETPERM */
529 	do_keyctl(ARG_STR(KEYCTL_SETPERM),
530 		  sizeof(int32_t), ARG_STR(KEY_SPEC_REQKEY_AUTH_KEY), NULL,
531 		  sizeof(uint32_t), 0xffffffffU,
532 			"KEY_POS_VIEW|KEY_POS_READ|KEY_POS_WRITE|"
533 			"KEY_POS_SEARCH|KEY_POS_LINK|KEY_POS_SETATTR|"
534 			"KEY_USR_VIEW|KEY_USR_READ|KEY_USR_WRITE|"
535 			"KEY_USR_SEARCH|KEY_USR_LINK|KEY_USR_SETATTR|"
536 			"KEY_GRP_VIEW|KEY_GRP_READ|KEY_GRP_WRITE|"
537 			"KEY_GRP_SEARCH|KEY_GRP_LINK|KEY_GRP_SETATTR|"
538 			"KEY_OTH_VIEW|KEY_OTH_READ|KEY_OTH_WRITE|"
539 			"KEY_OTH_SEARCH|KEY_OTH_LINK|KEY_OTH_SETATTR|"
540 			"0xc0c0c0c0", NULL,
541 		  0UL);
542 	do_keyctl(ARG_STR(KEYCTL_SETPERM),
543 		  sizeof(int32_t), bogus_key1, NULL, "%d",
544 		  sizeof(uint32_t), 0, NULL, "%#x",
545 		  0UL);
546 	do_keyctl(ARG_STR(KEYCTL_SETPERM),
547 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
548 		  sizeof(uint32_t), 0xc0c0c0c0, "0xc0c0c0c0 /* KEY_??? */",
549 			  NULL,
550 		  0UL);
551 
552 
553 	/* KEYCTL_DESCRIBE */
554 	do_keyctl(ARG_STR(KEYCTL_DESCRIBE),
555 		  sizeof(int32_t), bogus_key1, NULL, "%d",
556 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
557 		  sizeof(kernel_ulong_t),
558 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, NULL, ksize_fmt,
559 		  0UL);
560 	do_keyctl(ARG_STR(KEYCTL_DESCRIBE),
561 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
562 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
563 		  sizeof(kernel_ulong_t),
564 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, NULL, ksize_fmt,
565 		  0UL);
566 	do_keyctl(ARG_STR(KEYCTL_DESCRIBE),
567 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), NULL,
568 		  (size_t) 9, (uintptr_t) bogus_buf1, NULL, NULL,
569 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 9, NULL, ksize_fmt,
570 		  0UL);
571 	do_keyctl(ARG_STR(KEYCTL_DESCRIBE),
572 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), NULL,
573 		  (size_t) 256, (uintptr_t) bogus_buf2, NULL, NULL,
574 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 256, NULL, ksize_fmt,
575 		  0UL);
576 	do_keyctl(ARG_STR(KEYCTL_DESCRIBE),
577 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), NULL,
578 		  (size_t) -4, (uintptr_t) bogus_buf2, NULL, NULL,
579 		  sizeof(kernel_ulong_t), (kernel_ulong_t) -4, NULL, ksize_fmt,
580 		  0UL);
581 
582 
583 	/* KEYCTL_CLEAR */
584 	do_keyctl(ARG_STR(KEYCTL_CLEAR),
585 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL,
586 		  0UL);
587 	do_keyctl(ARG_STR(KEYCTL_CLEAR),
588 		  sizeof(int32_t), bogus_key1, NULL, "%d",
589 		  0UL);
590 	do_keyctl(ARG_STR(KEYCTL_CLEAR),
591 		  sizeof(int32_t), bogus_key2, NULL, "%d",
592 		  0UL);
593 	do_keyctl(ARG_STR(KEYCTL_CLEAR),
594 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
595 		  0UL);
596 
597 
598 	/* KEYCTL_LINK */
599 	do_keyctl(ARG_STR(KEYCTL_LINK),
600 		  sizeof(int32_t), bogus_key1, NULL, "%d",
601 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL,
602 		  0UL);
603 	do_keyctl(ARG_STR(KEYCTL_LINK),
604 		  sizeof(int32_t), ARG_STR(KEY_SPEC_REQUESTOR_KEYRING), NULL,
605 		  sizeof(int32_t), bogus_key2, NULL, "%d",
606 		  0UL);
607 	do_keyctl(ARG_STR(KEYCTL_LINK),
608 		  sizeof(int32_t), ARG_STR(KEY_SPEC_REQUESTOR_KEYRING), NULL,
609 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
610 		  0UL);
611 
612 
613 	/* KEYCTL_UNLINK */
614 	do_keyctl(ARG_STR(KEYCTL_UNLINK),
615 		  sizeof(int32_t), bogus_key1, NULL, "%d",
616 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL,
617 		  0UL);
618 	do_keyctl(ARG_STR(KEYCTL_UNLINK),
619 		  sizeof(int32_t), ARG_STR(KEY_SPEC_REQUESTOR_KEYRING), NULL,
620 		  sizeof(int32_t), bogus_key2, NULL, "%d",
621 		  0UL);
622 	do_keyctl(ARG_STR(KEYCTL_UNLINK),
623 		  sizeof(int32_t), ARG_STR(KEY_SPEC_REQUESTOR_KEYRING), NULL,
624 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
625 		  0UL);
626 
627 
628 	/* KEYCTL_SEARCH */
629 	buf_in_arg = true;
630 
631 	do_keyctl(ARG_STR(KEYCTL_SEARCH),
632 		  sizeof(int32_t), ARG_STR(KEY_SPEC_REQUESTOR_KEYRING), NULL,
633 		  sizeof(char *), ARG_STR(NULL), NULL,
634 		  sizeof(char *), ARG_STR(NULL), NULL,
635 		  sizeof(int32_t), 0, NULL, "%d");
636 	do_keyctl(ARG_STR(KEYCTL_SEARCH),
637 		  sizeof(int32_t), bogus_key1, NULL, "%d",
638 		  sizeof(char *), (char *) 0xfffffacefffffeedULL, NULL, ptr_fmt,
639 		  sizeof(char *), (char *) 0xfffff00dfffff157ULL, NULL, ptr_fmt,
640 		  sizeof(int32_t), ARG_STR(KEY_SPEC_USER_SESSION_KEYRING),
641 			  NULL);
642 	do_keyctl(ARG_STR(KEYCTL_SEARCH),
643 		  sizeof(int32_t), bogus_key2, NULL, "%d",
644 		  sizeof(char *), bogus_str, NULL, ptr_fmt,
645 		  sizeof(char *), bogus_desc, NULL, ptr_fmt,
646 		  sizeof(int32_t), bogus_key1, NULL, "%d");
647 	do_keyctl(ARG_STR(KEYCTL_SEARCH),
648 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
649 		  sizeof(short_type_str), short_type, NULL, NULL,
650 		  sizeof(short_desc_str), short_desc, NULL, NULL,
651 		  sizeof(int32_t), bogus_key2, NULL, "%d");
652 	do_keyctl(ARG_STR(KEYCTL_SEARCH),
653 		  sizeof(int32_t), 0, NULL, "%d",
654 		  sizeof(long_type_str), long_type, NULL, NULL,
655 		  sizeof(long_type_str), long_desc, NULL, NULL,
656 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL);
657 
658 	/* KEYCTL_RESTRICT_KEYRING */
659 
660 	do_keyctl(ARG_STR(KEYCTL_RESTRICT_KEYRING),
661 		  sizeof(int32_t), ARG_STR(KEY_SPEC_REQUESTOR_KEYRING), NULL,
662 		  sizeof(char *), ARG_STR(NULL), NULL,
663 		  sizeof(char *), ARG_STR(NULL), NULL,
664 			  NULL);
665 	do_keyctl(ARG_STR(KEYCTL_RESTRICT_KEYRING),
666 		  sizeof(int32_t), bogus_key1, NULL, "%d",
667 		  sizeof(char *), (char *) 0xfffffacefffffeedULL, NULL, ptr_fmt,
668 		  sizeof(char *), (char *) 0xfffff00dfffff157ULL, NULL, ptr_fmt,
669 			  NULL);
670 	do_keyctl(ARG_STR(KEYCTL_RESTRICT_KEYRING),
671 		  sizeof(int32_t), bogus_key2, NULL, "%d",
672 		  sizeof(char *), bogus_str, NULL, ptr_fmt,
673 		  sizeof(char *), bogus_desc, NULL, ptr_fmt,
674 			  NULL);
675 	do_keyctl(ARG_STR(KEYCTL_RESTRICT_KEYRING),
676 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
677 		  sizeof(short_type_str), short_type, NULL, NULL,
678 		  sizeof(short_desc_str), short_desc, NULL, NULL,
679 			  NULL);
680 	do_keyctl(ARG_STR(KEYCTL_RESTRICT_KEYRING),
681 		  sizeof(int32_t), 0, NULL, "%d",
682 		  sizeof(long_type_str), long_type, NULL, NULL,
683 		  sizeof(long_type_str), long_desc, NULL, NULL,
684 			  NULL);
685 
686 	buf_in_arg = false;
687 
688 
689 	/* KEYCTL_READ */
690 	nul_terminated_buf = false;
691 
692 	/* Empty result is expected for these */
693 	bogus_buf1[0] = '\377';
694 	bogus_buf2[0] = '\377';
695 
696 	do_keyctl(ARG_STR(KEYCTL_READ),
697 		  sizeof(int32_t), bogus_key1, NULL, "%d",
698 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
699 		  sizeof(kernel_ulong_t),
700 		  (kernel_ulong_t) 0xfeedf157badc0dedLLU, NULL, ksize_fmt,
701 		  0UL);
702 	do_keyctl(ARG_STR(KEYCTL_READ),
703 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
704 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
705 		  sizeof(kernel_ulong_t),
706 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, NULL, ksize_fmt,
707 		  0UL);
708 	do_keyctl(ARG_STR(KEYCTL_READ),
709 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), NULL,
710 		  (size_t) 9, (uintptr_t) bogus_buf1, NULL, NULL,
711 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 9, NULL, ksize_fmt,
712 		  0UL);
713 	do_keyctl(ARG_STR(KEYCTL_READ),
714 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), NULL,
715 		  (size_t) 256, (uintptr_t) bogus_buf2, NULL, NULL,
716 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 256, NULL, ksize_fmt,
717 		  0UL);
718 	do_keyctl(ARG_STR(KEYCTL_READ),
719 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), NULL,
720 		  (size_t) -4, (uintptr_t) bogus_buf2, NULL, NULL,
721 		  sizeof(kernel_ulong_t), (kernel_ulong_t) -4, NULL, ksize_fmt,
722 		  0UL);
723 
724 	nul_terminated_buf = true;
725 
726 	/* KEYCTL_INSTANTIATE */
727 	buf_in_arg = true;
728 
729 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE),
730 		  sizeof(int32_t), 0, NULL, "%d",
731 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
732 		  sizeof(kernel_ulong_t),
733 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, NULL, ksize_fmt,
734 		  sizeof(int32_t), 0, NULL, "%d");
735 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE),
736 		  sizeof(int32_t), bogus_key1, NULL, "%d",
737 		  sizeof(char *), (char *) 0xfffffacefffffeedULL, NULL, ptr_fmt,
738 		  sizeof(kernel_ulong_t),
739 			(kernel_ulong_t) 0xdeadfeedLLU, NULL, ksize_fmt,
740 		  sizeof(int32_t), bogus_key1, NULL, "%d");
741 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE),
742 		  sizeof(int32_t), bogus_key2, NULL, "%d",
743 		  sizeof(char *), bogus_str, NULL, ptr_fmt,
744 		  sizeof(kernel_ulong_t),
745 			(kernel_ulong_t) 32LLU, NULL, ksize_fmt,
746 		  sizeof(int32_t), bogus_key2, NULL, "%d");
747 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE),
748 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
749 		  sizeof(short_type_str), short_desc, NULL, NULL,
750 		  sizeof(kernel_ulong_t),
751 			(kernel_ulong_t) sizeof(short_type_str) - 1, NULL,
752 			ksize_fmt,
753 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL);
754 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE),
755 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL,
756 		  sizeof(long_type_str), long_desc, NULL, NULL,
757 		  sizeof(kernel_ulong_t),
758 			(kernel_ulong_t) sizeof(long_type_str), NULL, ksize_fmt,
759 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL);
760 
761 	buf_in_arg = false;
762 
763 
764 	/* KEYCTL_NEGATE */
765 	do_keyctl(ARG_STR(KEYCTL_NEGATE),
766 		  sizeof(int32_t), 0, NULL, "%d",
767 		  sizeof(uint32_t), 0, NULL, "%u",
768 		  sizeof(int32_t), 0, NULL, "%d",
769 		  0UL);
770 	do_keyctl(ARG_STR(KEYCTL_NEGATE),
771 		  sizeof(int32_t), bogus_key1, NULL, "%d",
772 		  sizeof(uint32_t), 3141592653U, NULL, "%u",
773 		  sizeof(int32_t), bogus_key1, NULL, "%d",
774 		  0UL);
775 	do_keyctl(ARG_STR(KEYCTL_NEGATE),
776 		  sizeof(int32_t), bogus_key2, NULL, "%d",
777 		  sizeof(kernel_ulong_t),
778 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, "3134983661",
779 			NULL,
780 		  sizeof(int32_t), bogus_key2, NULL, "%d",
781 		  0UL);
782 	do_keyctl(ARG_STR(KEYCTL_NEGATE),
783 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
784 		  sizeof(kernel_ulong_t),
785 		  (kernel_ulong_t) 0xfeedf157badc0dedLLU, "3134983661", NULL,
786 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
787 		  0UL);
788 
789 
790 	/* KEYCTL_SET_REQKEY_KEYRING */
791 	do_keyctl(ARG_STR(KEYCTL_SET_REQKEY_KEYRING),
792 		  sizeof(int32_t), ARG_STR(KEY_REQKEY_DEFL_NO_CHANGE), NULL,
793 		  0UL);
794 	/*
795 	 * Keep it commented out until proper way of faking syscalls is not
796 	 * implemented.
797 	 */
798 	/* do_keyctl(ARG_STR(KEYCTL_SET_REQKEY_KEYRING),
799 		  sizeof(int32_t),
800 		  ARG_STR(KEY_REQKEY_DEFL_REQUESTOR_KEYRING), NULL, 0UL); */
801 	do_keyctl(ARG_STR(KEYCTL_SET_REQKEY_KEYRING),
802 		  sizeof(kernel_ulong_t),
803 		  (kernel_ulong_t) 0xfeedf157badc0dedLLU,
804 		  "0xbadc0ded /* KEY_REQKEY_DEFL_??? */", NULL, 0UL);
805 
806 
807 	/* KEYCTL_SET_TIMEOUT */
808 	do_keyctl(ARG_STR(KEYCTL_SET_TIMEOUT),
809 		  sizeof(int32_t), 0, NULL, "%d",
810 		  sizeof(uint32_t), 0, NULL, "%u",
811 		  0UL);
812 	do_keyctl(ARG_STR(KEYCTL_SET_TIMEOUT),
813 		  sizeof(int32_t), bogus_key1, NULL, "%d",
814 		  sizeof(uint32_t), 3141592653U, NULL, "%u",
815 		  0UL);
816 	do_keyctl(ARG_STR(KEYCTL_SET_TIMEOUT),
817 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
818 		  sizeof(kernel_ulong_t),
819 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, "3134983661",
820 			NULL,
821 		  0UL);
822 
823 
824 	/* KEYCTL_ASSUME_AUTHORITY */
825 	do_keyctl(ARG_STR(KEYCTL_ASSUME_AUTHORITY),
826 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL,
827 		  0UL);
828 	do_keyctl(ARG_STR(KEYCTL_ASSUME_AUTHORITY),
829 		  sizeof(int32_t), bogus_key1, NULL, "%d",
830 		  0UL);
831 	do_keyctl(ARG_STR(KEYCTL_ASSUME_AUTHORITY),
832 		  sizeof(int32_t), bogus_key2, NULL, "%d",
833 		  0UL);
834 	do_keyctl(ARG_STR(KEYCTL_ASSUME_AUTHORITY),
835 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
836 		  0UL);
837 
838 
839 	/* KEYCTL_GET_SECURITY */
840 	do_keyctl(ARG_STR(KEYCTL_GET_SECURITY),
841 		  sizeof(int32_t), bogus_key1, NULL, "%d",
842 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
843 		  sizeof(uint32_t), 0xbadc0dedU, NULL, "%u",
844 		  0UL);
845 	do_keyctl(ARG_STR(KEYCTL_GET_SECURITY),
846 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
847 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
848 		  sizeof(kernel_ulong_t),
849 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, NULL, ksize_fmt,
850 		  0UL);
851 	do_keyctl(ARG_STR(KEYCTL_GET_SECURITY),
852 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), NULL,
853 		  (size_t) 9, (uintptr_t) bogus_buf1, NULL, NULL,
854 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 9, NULL, ksize_fmt,
855 		  0UL);
856 	do_keyctl(ARG_STR(KEYCTL_GET_SECURITY),
857 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), NULL,
858 		  (size_t) 256, (uintptr_t) bogus_buf2, NULL, NULL,
859 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 256, NULL, ksize_fmt,
860 		  0UL);
861 	do_keyctl(ARG_STR(KEYCTL_GET_SECURITY),
862 		  sizeof(int32_t), ARG_STR(KEY_SPEC_THREAD_KEYRING), NULL,
863 		  (size_t) -4, (uintptr_t) bogus_buf2, NULL, NULL,
864 		  sizeof(kernel_ulong_t), (kernel_ulong_t) -4, NULL, ksize_fmt,
865 		  0UL);
866 
867 
868 	/* KEYCTL_SESSION_TO_PARENT */
869 	do_keyctl(ARG_STR(KEYCTL_SESSION_TO_PARENT), 0UL);
870 
871 
872 	/* KEYCTL_REJECT */
873 	do_keyctl(ARG_STR(KEYCTL_REJECT),
874 		  sizeof(int32_t), 0, NULL, "%d",
875 		  sizeof(uint32_t), 0, NULL, "%u",
876 		  sizeof(uint32_t), 0, NULL, "%u",
877 		  sizeof(int32_t), 0, NULL, "%d");
878 	do_keyctl(ARG_STR(KEYCTL_REJECT),
879 		  sizeof(int32_t), bogus_key1, NULL, "%d",
880 		  sizeof(uint32_t), 3141592653U, NULL, "%u",
881 		  sizeof(uint32_t), 2718281828U, NULL, "%u",
882 		  sizeof(int32_t), bogus_key1, NULL, "%d");
883 	do_keyctl(ARG_STR(KEYCTL_REJECT),
884 		  sizeof(int32_t), bogus_key2, NULL, "%d",
885 		  sizeof(kernel_ulong_t),
886 			(kernel_ulong_t) 0xdeadca75facef157LLU, "4207866199",
887 			NULL,
888 		  sizeof(kernel_ulong_t),
889 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, "3134983661",
890 			NULL,
891 		  sizeof(int32_t), bogus_key2, NULL, "%d");
892 	do_keyctl(ARG_STR(KEYCTL_REJECT),
893 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
894 		  sizeof(kernel_ulong_t),
895 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, "3134983661",
896 			NULL,
897 		  sizeof(uint32_t), ARG_STR(ENODEV), NULL,
898 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL);
899 
900 
901 	/* KEYCTL_INSTANTIATE_IOV */
902 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE_IOV),
903 		  sizeof(int32_t), 0, NULL, "%d",
904 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
905 		  sizeof(kernel_ulong_t),
906 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, NULL, ksize_fmt,
907 		  sizeof(int32_t), 0, NULL, "%d");
908 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE_IOV),
909 		  sizeof(int32_t), bogus_key1, NULL, "%d",
910 		  sizeof(char *), (char *) 0xfffffacefffffeedULL, NULL, ptr_fmt,
911 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 0xdeadfeedLLU, NULL,
912 			ksize_fmt,
913 		  sizeof(int32_t), bogus_key1, NULL, "%d");
914 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE_IOV),
915 		  sizeof(int32_t), bogus_key2, NULL, "%d",
916 		  sizeof(char *), key_iov + IOV_SIZE, NULL, ptr_fmt,
917 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 32LLU, NULL,
918 			ksize_fmt,
919 		  sizeof(int32_t), bogus_key2, NULL, "%d");
920 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE_IOV),
921 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
922 		  sizeof(key_iov), key_iov + IOV_SIZE - 4, key_iov_str1, NULL,
923 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 4, NULL,
924 			  ksize_fmt,
925 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL);
926 	do_keyctl(ARG_STR(KEYCTL_INSTANTIATE_IOV),
927 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL,
928 		  sizeof(key_iov), key_iov, key_iov_str2, NULL,
929 		  sizeof(kernel_ulong_t), (kernel_ulong_t) IOV_SIZE, NULL,
930 			ksize_fmt,
931 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL);
932 
933 
934 	/* KEYCTL_INVALIDATE */
935 	do_keyctl(ARG_STR(KEYCTL_INVALIDATE),
936 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL,
937 		  0UL);
938 	do_keyctl(ARG_STR(KEYCTL_INVALIDATE),
939 		  sizeof(int32_t), bogus_key1, NULL, "%d",
940 		  0UL);
941 	do_keyctl(ARG_STR(KEYCTL_INVALIDATE),
942 		  sizeof(int32_t), bogus_key2, NULL, "%d",
943 		  0UL);
944 	do_keyctl(ARG_STR(KEYCTL_INVALIDATE),
945 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
946 		  0UL);
947 
948 
949 	/* KEYCTL_GET_PERSISTENT */
950 	do_keyctl(ARG_STR(KEYCTL_GET_PERSISTENT),
951 		  sizeof(uid_t), ARG_STR(-1), NULL,
952 		  sizeof(int32_t), ARG_STR(KEY_SPEC_GROUP_KEYRING), NULL,
953 		  0UL);
954 	do_keyctl(ARG_STR(KEYCTL_GET_PERSISTENT),
955 		  sizeof(uid_t), 2718281828U, NULL, "%u",
956 		  sizeof(int32_t), bogus_key1, NULL, "%d",
957 		  0UL);
958 	do_keyctl(ARG_STR(KEYCTL_GET_PERSISTENT),
959 		  sizeof(uid_t), 2718281828U, NULL, "%u",
960 		  sizeof(kernel_ulong_t), bogus_key3, bogus_key3_str, NULL,
961 		  0UL);
962 
963 
964 	/* KEYCTL_DH_COMPUTE */
965 	nul_terminated_buf = false;
966 
967 	/* Empty result is expected for these */
968 	bogus_buf1[0] = '\377';
969 	bogus_buf2[0] = '\377';
970 
971 	do_keyctl(ARG_STR(KEYCTL_DH_COMPUTE),
972 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
973 		  sizeof(char *), ARG_STR(NULL), ptr_fmt,
974 		  sizeof(kernel_ulong_t),
975 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, NULL, ksize_fmt,
976 		  sizeof(char *), ARG_STR(NULL), ptr_fmt);
977 	do_keyctl(ARG_STR(KEYCTL_DH_COMPUTE),
978 		  sizeof(char *), kcdhp + 1, NULL, ptr_fmt,
979 		  sizeof(char *), (char *) 0xfffff157ffffdeadULL, NULL, ptr_fmt,
980 		  sizeof(kernel_ulong_t),
981 			(kernel_ulong_t) 0xfeedf157badc0dedLLU, NULL, ksize_fmt,
982 		  sizeof(char *), ARG_STR(NULL), ptr_fmt);
983 	do_keyctl(ARG_STR(KEYCTL_DH_COMPUTE),
984 		  sizeof(kcdhp), kcdhp, kcdhp_str, NULL,
985 		  (size_t) 9, (uintptr_t) bogus_buf1, NULL, NULL,
986 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 9, NULL, ksize_fmt,
987 		  sizeof(char *), ARG_STR(NULL), ptr_fmt);
988 	do_keyctl(ARG_STR(KEYCTL_DH_COMPUTE),
989 		  sizeof(kcdhp), kcdhp, kcdhp_str, NULL,
990 		  (size_t) 256, (uintptr_t) bogus_buf2, NULL, NULL,
991 		  sizeof(kernel_ulong_t), (kernel_ulong_t) 256, NULL, ksize_fmt,
992 		  sizeof(char *), ARG_STR(NULL), ptr_fmt);
993 	do_keyctl(ARG_STR(KEYCTL_DH_COMPUTE),
994 		  sizeof(kcdhp), kcdhp, kcdhp_str, NULL,
995 		  (size_t) -1, (uintptr_t) bogus_buf2, NULL, NULL,
996 		  sizeof(kernel_ulong_t), (kernel_ulong_t) -1, NULL, ksize_fmt,
997 		  sizeof(char *), kckdfp_char + 1, NULL, ptr_fmt);
998 
999 	/* KEYCTL_DH_COMPUTE + KDF */
1000 
1001 	for (i = 0; i < ARRAY_SIZE(kckdfp_data); i++) {
1002 		struct keyctl_kdf_params *kckdfp =
1003 			(struct keyctl_kdf_params *) kckdfp_char;
1004 		bool deref_hash = true;
1005 		bool deref_opts = true;
1006 		bool print_spare = false;
1007 		const char *hash_str = NULL;
1008 		const char *oi_str = NULL;
1009 
1010 		memcpy(kckdfp, kckdfp_data + i, sizeof(kckdfp_data[i]));
1011 
1012 		switch (i) {
1013 		case 1:
1014 			deref_hash = false;
1015 			print_spare = true;
1016 			kckdfp->hashname =
1017 				kckdfp_short_hash + sizeof(short_hash_data);
1018 			break;
1019 		case 2:
1020 			deref_opts = false;
1021 			kckdfp->hashname = kckdfp_long_hash;
1022 			kckdfp->otherinfo =
1023 				kckdfp_otherinfo1 + sizeof(otherinfo1_data);
1024 			break;
1025 		case 3:
1026 			deref_opts = false;
1027 			deref_hash = false;
1028 			print_spare = true;
1029 			kckdfp->hashname = bogus_str;
1030 			kckdfp->otherinfo = kckdfp_otherinfo1;
1031 			break;
1032 		case 4:
1033 			oi_str = "\"\\1\\2 OH HAI \"...";
1034 			print_spare = true;
1035 			kckdfp->hashname = kckdfp_short_hash;
1036 			kckdfp->otherinfo = kckdfp_otherinfo1;
1037 			break;
1038 		case 5:
1039 			oi_str = "\"\\1\\2\\n\\255\\0\\1\\0\"";
1040 			kckdfp->hashname = kckdfp_short_hash;
1041 			kckdfp->otherinfo = kckdfp_otherinfo2;
1042 			break;
1043 		}
1044 
1045 		do_keyctl(ARG_STR(KEYCTL_DH_COMPUTE),
1046 			  sizeof(kcdhp), kcdhp, kcdhp_str, NULL,
1047 			  (size_t) -1, (uintptr_t) bogus_buf2, NULL, NULL,
1048 			  sizeof(kernel_ulong_t), (kernel_ulong_t) -1, NULL,
1049 				ksize_fmt,
1050 			  sizeof(kckdfp), kckdfp_char,
1051 				kckdfp_to_str(kckdfp, deref_hash, deref_opts,
1052 					      print_spare, hash_str, oi_str),
1053 				NULL);
1054 	}
1055 
1056 	nul_terminated_buf = true;
1057 
1058 	puts("+++ exited with 0 +++");
1059 
1060 	return 0;
1061 }
1062 
1063 #else
1064 
1065 SKIP_MAIN_UNDEFINED("__NR_keyctl");
1066 
1067 #endif
1068