Commit a3c812f7 authored by Eric Biggers's avatar Eric Biggers Committed by James Morris

KEYS: trusted: fix writing past end of buffer in trusted_read()

When calling keyctl_read() on a key of type "trusted", if the
user-supplied buffer was too small, the kernel ignored the buffer length
and just wrote past the end of the buffer, potentially corrupting
userspace memory.  Fix it by instead returning the size required, as per
the documentation for keyctl_read().

We also don't even fill the buffer at all in this case, as this is
slightly easier to implement than doing a short read, and either
behavior appears to be permitted.  It also makes it match the behavior
of the "encrypted" key type.

Fixes: d00a1c72 ("keys: add new trusted key-type")
Reported-by: default avatarBen Hutchings <ben@decadent.org.uk>
Cc: <stable@vger.kernel.org> # v2.6.38+
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Reviewed-by: default avatarMimi Zohar <zohar@linux.vnet.ibm.com>
Reviewed-by: default avatarJames Morris <james.l.morris@oracle.com>
Signed-off-by: default avatarJames Morris <james.l.morris@oracle.com>
parent 3239b6f2
...@@ -1147,8 +1147,8 @@ static long trusted_read(const struct key *key, char __user *buffer, ...@@ -1147,8 +1147,8 @@ static long trusted_read(const struct key *key, char __user *buffer,
p = dereference_key_locked(key); p = dereference_key_locked(key);
if (!p) if (!p)
return -EINVAL; return -EINVAL;
if (!buffer || buflen <= 0)
return 2 * p->blob_len; if (buffer && buflen >= 2 * p->blob_len) {
ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL); ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
if (!ascii_buf) if (!ascii_buf)
return -ENOMEM; return -ENOMEM;
...@@ -1156,11 +1156,12 @@ static long trusted_read(const struct key *key, char __user *buffer, ...@@ -1156,11 +1156,12 @@ static long trusted_read(const struct key *key, char __user *buffer,
bufp = ascii_buf; bufp = ascii_buf;
for (i = 0; i < p->blob_len; i++) for (i = 0; i < p->blob_len; i++)
bufp = hex_byte_pack(bufp, p->blob[i]); bufp = hex_byte_pack(bufp, p->blob[i]);
if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) { if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) {
kzfree(ascii_buf); kzfree(ascii_buf);
return -EFAULT; return -EFAULT;
} }
kzfree(ascii_buf); kzfree(ascii_buf);
}
return 2 * p->blob_len; return 2 * p->blob_len;
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment