| From 5649645d725c73df4302428ee4e02c869248b4c5 Mon Sep 17 00:00:00 2001 |
| From: Eric Biggers <ebiggers@google.com> |
| Date: Thu, 8 Jun 2017 14:48:40 +0100 |
| Subject: KEYS: fix dereferencing NULL payload with nonzero length |
| |
| From: Eric Biggers <ebiggers@google.com> |
| |
| commit 5649645d725c73df4302428ee4e02c869248b4c5 upstream. |
| |
| sys_add_key() and the KEYCTL_UPDATE operation of sys_keyctl() allowed a |
| NULL payload with nonzero length to be passed to the key type's |
| ->preparse(), ->instantiate(), and/or ->update() methods. Various key |
| types including asymmetric, cifs.idmap, cifs.spnego, and pkcs7_test did |
| not handle this case, allowing an unprivileged user to trivially cause a |
| NULL pointer dereference (kernel oops) if one of these key types was |
| present. Fix it by doing the copy_from_user() when 'plen' is nonzero |
| rather than when '_payload' is non-NULL, causing the syscall to fail |
| with EFAULT as expected when an invalid buffer is specified. |
| |
| Signed-off-by: Eric Biggers <ebiggers@google.com> |
| Signed-off-by: David Howells <dhowells@redhat.com> |
| Signed-off-by: James Morris <james.l.morris@oracle.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| |
| --- |
| security/keys/keyctl.c | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| --- a/security/keys/keyctl.c |
| +++ b/security/keys/keyctl.c |
| @@ -97,7 +97,7 @@ SYSCALL_DEFINE5(add_key, const char __us |
| /* pull the payload in if one was supplied */ |
| payload = NULL; |
| |
| - if (_payload) { |
| + if (plen) { |
| ret = -ENOMEM; |
| payload = kmalloc(plen, GFP_KERNEL | __GFP_NOWARN); |
| if (!payload) { |
| @@ -327,7 +327,7 @@ long keyctl_update_key(key_serial_t id, |
| |
| /* pull the payload in if one was supplied */ |
| payload = NULL; |
| - if (_payload) { |
| + if (plen) { |
| ret = -ENOMEM; |
| payload = kmalloc(plen, GFP_KERNEL); |
| if (!payload) |
