From d831068f7199e909b91b29b917506290a9cdcfba Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 2 Oct 2017 12:11:41 +0200 Subject: [PATCH] 4.13-stable patches added patches: keys-prevent-keyctl_read-on-negative-key.patch --- ...l-terminator-indicator-when-chaining.patch | 52 ------------ ...a-race-condition-in-request-handling.patch | 34 -------- ...-prevent-keyctl_read-on-negative-key.patch | 80 +++++++++++++++++++ queue-4.13/series | 3 +- 4 files changed, 81 insertions(+), 88 deletions(-) delete mode 100644 queue-4.13/crypto-af_alg-remove-sgl-terminator-indicator-when-chaining.patch delete mode 100644 queue-4.13/dm-raid-fix-a-race-condition-in-request-handling.patch create mode 100644 queue-4.13/keys-prevent-keyctl_read-on-negative-key.patch diff --git a/queue-4.13/crypto-af_alg-remove-sgl-terminator-indicator-when-chaining.patch b/queue-4.13/crypto-af_alg-remove-sgl-terminator-indicator-when-chaining.patch deleted file mode 100644 index 1f19c562c12..00000000000 --- a/queue-4.13/crypto-af_alg-remove-sgl-terminator-indicator-when-chaining.patch +++ /dev/null @@ -1,52 +0,0 @@ -From smueller@chronox.de Mon Oct 2 11:36:13 2017 -From: Stephan Mueller -Date: Thu, 21 Sep 2017 10:16:53 +0200 -Subject: [PATCH - RESEND] crypto: AF_ALG - remove SGL terminator indicator when chaining -To: herbert@gondor.apana.org.au, greg@kroah.com -Cc: linux-crypto@vger.kernel.org -Message-ID: <5857040.2sfW0oRrdW@tauon.chronox.de> - -From: Stephan Mueller - -Not upstream as-is due to massive rewrite in commit 2d97591ef43d ("crypto: -af_alg - consolidation of duplicate code") - -The SGL is MAX_SGL_ENTS + 1 in size. The last SG entry is used for the -chaining and is properly updated with the sg_chain invocation. During -the filling-in of the initial SG entries, sg_mark_end is called for each -SG entry. This is appropriate as long as no additional SGL is chained -with the current SGL. However, when a new SGL is chained and the last -SG entry is updated with sg_chain, the last but one entry still contains -the end marker from the sg_mark_end. This end marker must be removed as -otherwise a walk of the chained SGLs will cause a NULL pointer -dereference at the last but one SG entry, because sg_next will return -NULL. - -The patch only applies to all kernels up to and including 4.13. The -patch 2d97591ef43d0587be22ad1b0d758d6df4999a0b added to 4.14-rc1 -introduced a complete new code base which addresses this bug in -a different way. Yet, that patch is too invasive for stable kernels -and was therefore not marked for stable. - -Fixes: 8ff590903d5fc ("crypto: algif_skcipher - User-space interface for skcipher operations") -Signed-off-by: Stephan Mueller -Acked-by: Herbert Xu -Signed-off-by: Greg Kroah-Hartman - ---- a/crypto/algif_skcipher.c -+++ b/crypto/algif_skcipher.c -@@ -139,8 +139,10 @@ static int skcipher_alloc_sgl(struct sock *sk) - sg_init_table(sgl->sg, MAX_SGL_ENTS + 1); - sgl->cur = 0; - -- if (sg) -+ if (sg) { - sg_chain(sg, MAX_SGL_ENTS + 1, sgl->sg); -+ sg_unmark_end(sg + (MAX_SGL_ENTS - 1)); -+ } - - list_add_tail(&sgl->list, &ctx->tsgl); - } --- -2.13.5 - diff --git a/queue-4.13/dm-raid-fix-a-race-condition-in-request-handling.patch b/queue-4.13/dm-raid-fix-a-race-condition-in-request-handling.patch deleted file mode 100644 index e3f6182b727..00000000000 --- a/queue-4.13/dm-raid-fix-a-race-condition-in-request-handling.patch +++ /dev/null @@ -1,34 +0,0 @@ -From c4d6a1b8e8ea79c439a4871cba540443c9eb13b9 Mon Sep 17 00:00:00 2001 -From: Shaohua Li -Date: Thu, 21 Sep 2017 10:29:22 -0700 -Subject: dm-raid: fix a race condition in request handling - -From: Shaohua Li - -commit c4d6a1b8e8ea79c439a4871cba540443c9eb13b9 upstream. - -raid_map calls pers->make_request, which missed the suspend check. Fix it with -the new md_handle_request API. - -Fix: cc27b0c78c79(md: fix deadlock between mddev_suspend() and md_write_start()) -Cc: Heinz Mauelshagen -Cc: Mike Snitzer -Reviewed-by: NeilBrown -Signed-off-by: Shaohua Li -Signed-off-by: Greg Kroah-Hartman - ---- - drivers/md/dm-raid.c | 2 +- - 1 file changed, 1 insertion(+), 1 deletion(-) - ---- a/drivers/md/dm-raid.c -+++ b/drivers/md/dm-raid.c -@@ -3238,7 +3238,7 @@ static int raid_map(struct dm_target *ti - if (unlikely(bio_end_sector(bio) > mddev->array_sectors)) - return DM_MAPIO_REQUEUE; - -- mddev->pers->make_request(mddev, bio); -+ md_handle_request(mddev, bio); - - return DM_MAPIO_SUBMITTED; - } diff --git a/queue-4.13/keys-prevent-keyctl_read-on-negative-key.patch b/queue-4.13/keys-prevent-keyctl_read-on-negative-key.patch new file mode 100644 index 00000000000..da311cd7859 --- /dev/null +++ b/queue-4.13/keys-prevent-keyctl_read-on-negative-key.patch @@ -0,0 +1,80 @@ +From 37863c43b2c6464f252862bf2e9768264e961678 Mon Sep 17 00:00:00 2001 +From: Eric Biggers +Date: Mon, 18 Sep 2017 11:37:23 -0700 +Subject: KEYS: prevent KEYCTL_READ on negative key + +From: Eric Biggers + +commit 37863c43b2c6464f252862bf2e9768264e961678 upstream. + +Because keyctl_read_key() looks up the key with no permissions +requested, it may find a negatively instantiated key. If the key is +also possessed, we went ahead and called ->read() on the key. But the +key payload will actually contain the ->reject_error rather than the +normal payload. Thus, the kernel oopses trying to read the +user_key_payload from memory address (int)-ENOKEY = 0x00000000ffffff82. + +Fortunately the payload data is stored inline, so it shouldn't be +possible to abuse this as an arbitrary memory read primitive... + +Reproducer: + keyctl new_session + keyctl request2 user desc '' @s + keyctl read $(keyctl show | awk '/user: desc/ {print $1}') + +It causes a crash like the following: + BUG: unable to handle kernel paging request at 00000000ffffff92 + IP: user_read+0x33/0xa0 + PGD 36a54067 P4D 36a54067 PUD 0 + Oops: 0000 [#1] SMP + CPU: 0 PID: 211 Comm: keyctl Not tainted 4.14.0-rc1 #337 + Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.10.2-20170228_101828-anatol 04/01/2014 + task: ffff90aa3b74c3c0 task.stack: ffff9878c0478000 + RIP: 0010:user_read+0x33/0xa0 + RSP: 0018:ffff9878c047bee8 EFLAGS: 00010246 + RAX: 0000000000000001 RBX: ffff90aa3d7da340 RCX: 0000000000000017 + RDX: 0000000000000000 RSI: 00000000ffffff82 RDI: ffff90aa3d7da340 + RBP: ffff9878c047bf00 R08: 00000024f95da94f R09: 0000000000000000 + R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000000 + R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 + FS: 00007f58ece69740(0000) GS:ffff90aa3e200000(0000) knlGS:0000000000000000 + CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 + CR2: 00000000ffffff92 CR3: 0000000036adc001 CR4: 00000000003606f0 + Call Trace: + keyctl_read_key+0xac/0xe0 + SyS_keyctl+0x99/0x120 + entry_SYSCALL_64_fastpath+0x1f/0xbe + RIP: 0033:0x7f58ec787bb9 + RSP: 002b:00007ffc8d401678 EFLAGS: 00000206 ORIG_RAX: 00000000000000fa + RAX: ffffffffffffffda RBX: 00007ffc8d402800 RCX: 00007f58ec787bb9 + RDX: 0000000000000000 RSI: 00000000174a63ac RDI: 000000000000000b + RBP: 0000000000000004 R08: 00007ffc8d402809 R09: 0000000000000020 + R10: 0000000000000000 R11: 0000000000000206 R12: 00007ffc8d402800 + R13: 00007ffc8d4016e0 R14: 0000000000000000 R15: 0000000000000000 + Code: e5 41 55 49 89 f5 41 54 49 89 d4 53 48 89 fb e8 a4 b4 ad ff 85 c0 74 09 80 3d b9 4c 96 00 00 74 43 48 8b b3 20 01 00 00 4d 85 ed <0f> b7 5e 10 74 29 4d 85 e4 74 24 4c 39 e3 4c 89 e2 4c 89 ef 48 + RIP: user_read+0x33/0xa0 RSP: ffff9878c047bee8 + CR2: 00000000ffffff92 + +Fixes: 61ea0c0ba904 ("KEYS: Skip key state checks when checking for possession") +Signed-off-by: Eric Biggers +Signed-off-by: David Howells +Signed-off-by: Greg Kroah-Hartman + +--- + security/keys/keyctl.c | 5 +++++ + 1 file changed, 5 insertions(+) + +--- a/security/keys/keyctl.c ++++ b/security/keys/keyctl.c +@@ -766,6 +766,11 @@ long keyctl_read_key(key_serial_t keyid, + + key = key_ref_to_ptr(key_ref); + ++ if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) { ++ ret = -ENOKEY; ++ goto error2; ++ } ++ + /* see if we can read it directly */ + ret = key_permission(key_ref, KEY_NEED_READ); + if (ret == 0) diff --git a/queue-4.13/series b/queue-4.13/series index fddb6b14d9e..812861de9c3 100644 --- a/queue-4.13/series +++ b/queue-4.13/series @@ -25,7 +25,6 @@ tracing-erase-irqsoff-trace-with-empty-write.patch tracing-remove-rcu-work-arounds-from-stack-tracer.patch md-raid5-fix-a-race-condition-in-stripe-batch.patch md-raid5-preserve-stripe_on_unplug_list-in-break_stripe_batch_list.patch -dm-raid-fix-a-race-condition-in-request-handling.patch scsi-scsi_transport_iscsi-fix-the-issue-that-iscsi_if_rx-doesn-t-parse-nlmsg-properly.patch scsi-aacraid-fix-2t-drives-on-smartioc-2000.patch scsi-aacraid-add-a-small-delay-after-iop-reset.patch @@ -42,4 +41,4 @@ security-keys-properly-zero-out-sensitive-key-material-in-big_key.patch security-keys-rewrite-all-of-big_key-crypto.patch keys-fix-writing-past-end-of-user-supplied-buffer-in-keyring_read.patch keys-prevent-creating-a-different-user-s-keyrings.patch -crypto-af_alg-remove-sgl-terminator-indicator-when-chaining.patch +keys-prevent-keyctl_read-on-negative-key.patch -- 2.47.3