Commit e645016a authored by Eric Biggers's avatar Eric Biggers Committed by David Howells

KEYS: fix writing past end of user-supplied buffer in keyring_read()

Userspace can call keyctl_read() on a keyring to get the list of IDs of
keys in the keyring.  But if the user-supplied buffer is too small, the
kernel would write the full list anyway --- which will corrupt whatever
userspace memory happened to be past the end of the buffer.  Fix it by
only filling the space that is available.

Fixes: b2a4df20 ("KEYS: Expand the capacity of a keyring")
Cc: <stable@vger.kernel.org>	[v3.13+]
Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
parent 7fc0786d
...@@ -423,7 +423,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m) ...@@ -423,7 +423,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
} }
struct keyring_read_iterator_context { struct keyring_read_iterator_context {
size_t qty; size_t buflen;
size_t count; size_t count;
key_serial_t __user *buffer; key_serial_t __user *buffer;
}; };
...@@ -435,9 +435,9 @@ static int keyring_read_iterator(const void *object, void *data) ...@@ -435,9 +435,9 @@ static int keyring_read_iterator(const void *object, void *data)
int ret; int ret;
kenter("{%s,%d},,{%zu/%zu}", kenter("{%s,%d},,{%zu/%zu}",
key->type->name, key->serial, ctx->count, ctx->qty); key->type->name, key->serial, ctx->count, ctx->buflen);
if (ctx->count >= ctx->qty) if (ctx->count >= ctx->buflen)
return 1; return 1;
ret = put_user(key->serial, ctx->buffer); ret = put_user(key->serial, ctx->buffer);
...@@ -472,16 +472,12 @@ static long keyring_read(const struct key *keyring, ...@@ -472,16 +472,12 @@ static long keyring_read(const struct key *keyring,
return 0; return 0;
/* Calculate how much data we could return */ /* Calculate how much data we could return */
ctx.qty = nr_keys * sizeof(key_serial_t);
if (!buffer || !buflen) if (!buffer || !buflen)
return ctx.qty; return nr_keys * sizeof(key_serial_t);
if (buflen > ctx.qty)
ctx.qty = buflen;
/* Copy the IDs of the subscribed keys into the buffer */ /* Copy the IDs of the subscribed keys into the buffer */
ctx.buffer = (key_serial_t __user *)buffer; ctx.buffer = (key_serial_t __user *)buffer;
ctx.buflen = buflen;
ctx.count = 0; ctx.count = 0;
ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx); ret = assoc_array_iterate(&keyring->keys, keyring_read_iterator, &ctx);
if (ret < 0) { if (ret < 0) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment