• David Howells's avatar
    KEYS: Fix the size of the key description passed to/from userspace · aa9d4437
    David Howells authored
    When a key description argument is imported into the kernel from userspace, as
    happens in add_key(), request_key(), KEYCTL_JOIN_SESSION_KEYRING,
    KEYCTL_SEARCH, the description is copied into a buffer up to PAGE_SIZE in size.
    PAGE_SIZE, however, is a variable quantity, depending on the arch.  Fix this at
    4096 instead (ie. 4095 plus a NUL termination) and define a constant
    (KEY_MAX_DESC_SIZE) to this end.
    
    When reading the description back with KEYCTL_DESCRIBE, a PAGE_SIZE internal
    buffer is allocated into which the information and description will be
    rendered.  This means that the description will get truncated if an extremely
    long description it has to be crammed into the buffer with the stringified
    information.  There is no particular need to copy the description into the
    buffer, so just copy it directly to userspace in a separate operation.
    Reported-by: default avatarChristian Kastner <debian@kvr.at>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    Tested-by: default avatarChristian Kastner <debian@kvr.at>
    aa9d4437
keyctl.c 40.8 KB