From: Greg Kroah-Hartman Date: Tue, 31 Oct 2017 08:37:34 +0000 (+0100) Subject: 4.9-stable patches X-Git-Tag: v3.18.79~3 X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=f08cd1fc35e0af7755a64faab69e8e6083189474;p=thirdparty%2Fkernel%2Fstable-queue.git 4.9-stable patches added patches: ecryptfs-fix-dereference-of-null-user_key_payload.patch --- diff --git a/queue-4.9/ecryptfs-fix-dereference-of-null-user_key_payload.patch b/queue-4.9/ecryptfs-fix-dereference-of-null-user_key_payload.patch new file mode 100644 index 00000000000..5c7da022438 --- /dev/null +++ b/queue-4.9/ecryptfs-fix-dereference-of-null-user_key_payload.patch @@ -0,0 +1,106 @@ +From f66665c09ab489a11ca490d6a82df57cfc1bea3e Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 9 Oct 2017 12:51:27 -0700 +Subject: ecryptfs: fix dereference of NULL user_key_payload + +From: Eric Biggers + +commit f66665c09ab489a11ca490d6a82df57cfc1bea3e upstream. + +In eCryptfs, we failed to verify that the authentication token keys are +not revoked before dereferencing their payloads, which is problematic +because the payload of a revoked key is NULL. request_key() *does* skip +revoked keys, but there is still a window where the key can be revoked +before we acquire the key semaphore. + +Fix it by updating ecryptfs_get_key_payload_data() to return +-EKEYREVOKED if the key payload is NULL. For completeness we check this +for "encrypted" keys as well as "user" keys, although encrypted keys +cannot be revoked currently. + +Alternatively we could use key_validate(), but since we'll also need to +fix ecryptfs_get_key_payload_data() to validate the payload length, it +seems appropriate to just check the payload pointer. + +Fixes: 237fead61998 ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig") +Reviewed-by: James Morris +Cc: Michael Halcrow +Signed-off-by: Eric Biggers +Signed-off-by: David Howells +Signed-off-by: Greg Kroah-Hartman + + +--- + fs/ecryptfs/ecryptfs_kernel.h | 24 +++++++++++++++++------- + fs/ecryptfs/keystore.c | 9 ++++++++- + 2 files changed, 25 insertions(+), 8 deletions(-) + +--- a/fs/ecryptfs/ecryptfs_kernel.h ++++ b/fs/ecryptfs/ecryptfs_kernel.h +@@ -84,11 +84,16 @@ struct ecryptfs_page_crypt_context { + static inline struct ecryptfs_auth_tok * + ecryptfs_get_encrypted_key_payload_data(struct key *key) + { +- if (key->type == &key_type_encrypted) +- return (struct ecryptfs_auth_tok *) +- (&((struct encrypted_key_payload *)key->payload.data[0])->payload_data); +- else ++ struct encrypted_key_payload *payload; ++ ++ if (key->type != &key_type_encrypted) + return NULL; ++ ++ payload = key->payload.data[0]; ++ if (!payload) ++ return ERR_PTR(-EKEYREVOKED); ++ ++ return (struct ecryptfs_auth_tok *)payload->payload_data; + } + + static inline struct key *ecryptfs_get_encrypted_key(char *sig) +@@ -114,12 +119,17 @@ static inline struct ecryptfs_auth_tok * + ecryptfs_get_key_payload_data(struct key *key) + { + struct ecryptfs_auth_tok *auth_tok; ++ const struct user_key_payload *ukp; + + auth_tok = ecryptfs_get_encrypted_key_payload_data(key); +- if (!auth_tok) +- return (struct ecryptfs_auth_tok *)user_key_payload(key)->data; +- else ++ if (auth_tok) + return auth_tok; ++ ++ ukp = user_key_payload(key); ++ if (!ukp) ++ return ERR_PTR(-EKEYREVOKED); ++ ++ return (struct ecryptfs_auth_tok *)ukp->data; + } + + #define ECRYPTFS_MAX_KEYSET_SIZE 1024 +--- a/fs/ecryptfs/keystore.c ++++ b/fs/ecryptfs/keystore.c +@@ -459,7 +459,8 @@ out: + * @auth_tok_key: key containing the authentication token + * @auth_tok: authentication token + * +- * Returns zero on valid auth tok; -EINVAL otherwise ++ * Returns zero on valid auth tok; -EINVAL if the payload is invalid; or ++ * -EKEYREVOKED if the key was revoked before we acquired its semaphore. + */ + static int + ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key, +@@ -468,6 +469,12 @@ ecryptfs_verify_auth_tok_from_key(struct + int rc = 0; + + (*auth_tok) = ecryptfs_get_key_payload_data(auth_tok_key); ++ if (IS_ERR(*auth_tok)) { ++ rc = PTR_ERR(*auth_tok); ++ *auth_tok = NULL; ++ goto out; ++ } ++ + if (ecryptfs_verify_version((*auth_tok)->version)) { + printk(KERN_ERR "Data structure version mismatch. Userspace " + "tools must match eCryptfs kernel module with major " diff --git a/queue-4.9/series b/queue-4.9/series index 51501dfcbf5..c62e0b3b0b8 100644 --- a/queue-4.9/series +++ b/queue-4.9/series @@ -20,3 +20,4 @@ can-kvaser_usb-ignore-cmd_flush_queue_reply-messages.patch cfg80211-fix-connect-disconnect-edge-cases.patch ipsec-fix-aborted-xfrm-policy-dump-crash.patch regulator-fan53555-fix-i2c-device-ids.patch +ecryptfs-fix-dereference-of-null-user_key_payload.patch