+++ /dev/null
-From smueller@chronox.de Mon Oct 2 11:36:13 2017
-From: Stephan Mueller <smueller@chronox.de>
-Date: Thu, 21 Sep 2017 10:16:53 +0200
-Subject: [PATCH - RESEND] crypto: AF_ALG - remove SGL terminator indicator when chaining
-To: herbert@gondor.apana.org.au, greg@kroah.com
-Cc: linux-crypto@vger.kernel.org
-Message-ID: <5857040.2sfW0oRrdW@tauon.chronox.de>
-
-From: Stephan Mueller <smueller@chronox.de>
-
-Not upstream as-is due to massive rewrite in commit 2d97591ef43d ("crypto:
-af_alg - consolidation of duplicate code")
-
-The SGL is MAX_SGL_ENTS + 1 in size. The last SG entry is used for the
-chaining and is properly updated with the sg_chain invocation. During
-the filling-in of the initial SG entries, sg_mark_end is called for each
-SG entry. This is appropriate as long as no additional SGL is chained
-with the current SGL. However, when a new SGL is chained and the last
-SG entry is updated with sg_chain, the last but one entry still contains
-the end marker from the sg_mark_end. This end marker must be removed as
-otherwise a walk of the chained SGLs will cause a NULL pointer
-dereference at the last but one SG entry, because sg_next will return
-NULL.
-
-The patch only applies to all kernels up to and including 4.13. The
-patch 2d97591ef43d0587be22ad1b0d758d6df4999a0b added to 4.14-rc1
-introduced a complete new code base which addresses this bug in
-a different way. Yet, that patch is too invasive for stable kernels
-and was therefore not marked for stable.
-
-Fixes: 8ff590903d5fc ("crypto: algif_skcipher - User-space interface for skcipher operations")
-Signed-off-by: Stephan Mueller <smueller@chronox.de>
-Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
---- a/crypto/algif_skcipher.c
-+++ b/crypto/algif_skcipher.c
-@@ -139,8 +139,10 @@ static int skcipher_alloc_sgl(struct sock *sk)
- sg_init_table(sgl->sg, MAX_SGL_ENTS + 1);
- sgl->cur = 0;
-
-- if (sg)
-+ if (sg) {
- sg_chain(sg, MAX_SGL_ENTS + 1, sgl->sg);
-+ sg_unmark_end(sg + (MAX_SGL_ENTS - 1));
-+ }
-
- list_add_tail(&sgl->list, &ctx->tsgl);
- }
---
-2.13.5
-
+++ /dev/null
-From c4d6a1b8e8ea79c439a4871cba540443c9eb13b9 Mon Sep 17 00:00:00 2001
-From: Shaohua Li <shli@fb.com>
-Date: Thu, 21 Sep 2017 10:29:22 -0700
-Subject: dm-raid: fix a race condition in request handling
-
-From: Shaohua Li <shli@fb.com>
-
-commit c4d6a1b8e8ea79c439a4871cba540443c9eb13b9 upstream.
-
-raid_map calls pers->make_request, which missed the suspend check. Fix it with
-the new md_handle_request API.
-
-Fix: cc27b0c78c79(md: fix deadlock between mddev_suspend() and md_write_start())
-Cc: Heinz Mauelshagen <heinzm@redhat.com>
-Cc: Mike Snitzer <snitzer@redhat.com>
-Reviewed-by: NeilBrown <neilb@suse.com>
-Signed-off-by: Shaohua Li <shli@fb.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
----
- drivers/md/dm-raid.c | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
---- a/drivers/md/dm-raid.c
-+++ b/drivers/md/dm-raid.c
-@@ -3238,7 +3238,7 @@ static int raid_map(struct dm_target *ti
- if (unlikely(bio_end_sector(bio) > mddev->array_sectors))
- return DM_MAPIO_REQUEUE;
-
-- mddev->pers->make_request(mddev, bio);
-+ md_handle_request(mddev, bio);
-
- return DM_MAPIO_SUBMITTED;
- }
--- /dev/null
+From 37863c43b2c6464f252862bf2e9768264e961678 Mon Sep 17 00:00:00 2001
+From: Eric Biggers <ebiggers@google.com>
+Date: Mon, 18 Sep 2017 11:37:23 -0700
+Subject: KEYS: prevent KEYCTL_READ on negative key
+
+From: Eric Biggers <ebiggers@google.com>
+
+commit 37863c43b2c6464f252862bf2e9768264e961678 upstream.
+
+Because keyctl_read_key() looks up the key with no permissions
+requested, it may find a negatively instantiated key. If the key is
+also possessed, we went ahead and called ->read() on the key. But the
+key payload will actually contain the ->reject_error rather than the
+normal payload. Thus, the kernel oopses trying to read the
+user_key_payload from memory address (int)-ENOKEY = 0x00000000ffffff82.
+
+Fortunately the payload data is stored inline, so it shouldn't be
+possible to abuse this as an arbitrary memory read primitive...
+
+Reproducer:
+ keyctl new_session
+ keyctl request2 user desc '' @s
+ keyctl read $(keyctl show | awk '/user: desc/ {print $1}')
+
+It causes a crash like the following:
+ BUG: unable to handle kernel paging request at 00000000ffffff92
+ IP: user_read+0x33/0xa0
+ PGD 36a54067 P4D 36a54067 PUD 0
+ Oops: 0000 [#1] SMP
+ CPU: 0 PID: 211 Comm: keyctl Not tainted 4.14.0-rc1 #337
+ Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-20170228_101828-anatol 04/01/2014
+ task: ffff90aa3b74c3c0 task.stack: ffff9878c0478000
+ RIP: 0010:user_read+0x33/0xa0
+ RSP: 0018:ffff9878c047bee8 EFLAGS: 00010246
+ RAX: 0000000000000001 RBX: ffff90aa3d7da340 RCX: 0000000000000017
+ RDX: 0000000000000000 RSI: 00000000ffffff82 RDI: ffff90aa3d7da340
+ RBP: ffff9878c047bf00 R08: 00000024f95da94f R09: 0000000000000000
+ R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000
+ R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
+ FS: 00007f58ece69740(0000) GS:ffff90aa3e200000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+ CR2: 00000000ffffff92 CR3: 0000000036adc001 CR4: 00000000003606f0
+ Call Trace:
+ keyctl_read_key+0xac/0xe0
+ SyS_keyctl+0x99/0x120
+ entry_SYSCALL_64_fastpath+0x1f/0xbe
+ RIP: 0033:0x7f58ec787bb9
+ RSP: 002b:00007ffc8d401678 EFLAGS: 00000206 ORIG_RAX: 00000000000000fa
+ RAX: ffffffffffffffda RBX: 00007ffc8d402800 RCX: 00007f58ec787bb9
+ RDX: 0000000000000000 RSI: 00000000174a63ac RDI: 000000000000000b
+ RBP: 0000000000000004 R08: 00007ffc8d402809 R09: 0000000000000020
+ R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffc8d402800
+ R13: 00007ffc8d4016e0 R14: 0000000000000000 R15: 0000000000000000
+ Code: e5 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb e8 a4 b4 ad ff 85 c0 74 09 80 3d b9 4c 96 00 00 74 43 48 8b b3 20 01 00 00 4d 85 ed <0f> b7 5e 10 74 29 4d 85 e4 74 24 4c 39 e3 4c 89 e2 4c 89 ef 48
+ RIP: user_read+0x33/0xa0 RSP: ffff9878c047bee8
+ CR2: 00000000ffffff92
+
+Fixes: 61ea0c0ba904 ("KEYS: Skip key state checks when checking for possession")
+Signed-off-by: Eric Biggers <ebiggers@google.com>
+Signed-off-by: David Howells <dhowells@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ security/keys/keyctl.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/security/keys/keyctl.c
++++ b/security/keys/keyctl.c
+@@ -766,6 +766,11 @@ long keyctl_read_key(key_serial_t keyid,
+
+ key = key_ref_to_ptr(key_ref);
+
++ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
++ ret = -ENOKEY;
++ goto error2;
++ }
++
+ /* see if we can read it directly */
+ ret = key_permission(key_ref, KEY_NEED_READ);
+ if (ret == 0)
tracing-remove-rcu-work-arounds-from-stack-tracer.patch
md-raid5-fix-a-race-condition-in-stripe-batch.patch
md-raid5-preserve-stripe_on_unplug_list-in-break_stripe_batch_list.patch
-dm-raid-fix-a-race-condition-in-request-handling.patch
scsi-scsi_transport_iscsi-fix-the-issue-that-iscsi_if_rx-doesn-t-parse-nlmsg-properly.patch
scsi-aacraid-fix-2t-drives-on-smartioc-2000.patch
scsi-aacraid-add-a-small-delay-after-iop-reset.patch
security-keys-rewrite-all-of-big_key-crypto.patch
keys-fix-writing-past-end-of-user-supplied-buffer-in-keyring_read.patch
keys-prevent-creating-a-different-user-s-keyrings.patch
-crypto-af_alg-remove-sgl-terminator-indicator-when-chaining.patch
+keys-prevent-keyctl_read-on-negative-key.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
