From: Greg Kroah-Hartman Date: Fri, 5 Jan 2024 14:29:54 +0000 (+0100) Subject: 6.6-stable patches X-Git-Tag: v4.14.335~11 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=12d799aabb511b5b9094221b786c75b369513959;p=thirdparty%2Fkernel%2Fstable-queue.git 6.6-stable patches added patches: keys-dns-fix-missing-size-check-of-v1-server-list-header.patch series --- diff --git a/queue-6.6/keys-dns-fix-missing-size-check-of-v1-server-list-header.patch b/queue-6.6/keys-dns-fix-missing-size-check-of-v1-server-list-header.patch new file mode 100644 index 00000000000..90ef97eabd8 --- /dev/null +++ b/queue-6.6/keys-dns-fix-missing-size-check-of-v1-server-list-header.patch @@ -0,0 +1,114 @@ +From 1997b3cb4217b09e49659b634c94da47f0340409 Mon Sep 17 00:00:00 2001 +From: Edward Adam Davis +Date: Sun, 24 Dec 2023 00:02:49 +0000 +Subject: keys, dns: Fix missing size check of V1 server-list header + +From: Edward Adam Davis + +commit 1997b3cb4217b09e49659b634c94da47f0340409 upstream. + +The dns_resolver_preparse() function has a check on the size of the +payload for the basic header of the binary-style payload, but is missing +a check for the size of the V1 server-list payload header after +determining that's what we've been given. + +Fix this by getting rid of the the pointer to the basic header and just +assuming that we have a V1 server-list payload and moving the V1 server +list pointer inside the if-statement. Dealing with other types and +versions can be left for when such have been defined. + +This can be tested by doing the following with KASAN enabled: + + echo -n -e '\x0\x0\x1\x2' | keyctl padd dns_resolver foo @p + +and produces an oops like the following: + + BUG: KASAN: slab-out-of-bounds in dns_resolver_preparse+0xc9f/0xd60 net/dns_resolver/dns_key.c:127 + Read of size 1 at addr ffff888028894084 by task syz-executor265/5069 + ... + Call Trace: + dns_resolver_preparse+0xc9f/0xd60 net/dns_resolver/dns_key.c:127 + __key_create_or_update+0x453/0xdf0 security/keys/key.c:842 + key_create_or_update+0x42/0x50 security/keys/key.c:1007 + __do_sys_add_key+0x29c/0x450 security/keys/keyctl.c:134 + do_syscall_x64 arch/x86/entry/common.c:52 [inline] + do_syscall_64+0x40/0x110 arch/x86/entry/common.c:83 + entry_SYSCALL_64_after_hwframe+0x62/0x6a + +This patch was originally by Edward Adam Davis, but was modified by +Linus. + +Fixes: b946001d3bb1 ("keys, dns: Allow key types (eg. DNS) to be reclaimed immediately on expiry") +Reported-and-tested-by: syzbot+94bbb75204a05da3d89f@syzkaller.appspotmail.com +Link: https://lore.kernel.org/r/0000000000009b39bc060c73e209@google.com/ +Suggested-by: Linus Torvalds +Signed-off-by: Edward Adam Davis +Signed-off-by: David Howells +Tested-by: David Howells +Cc: Edward Adam Davis +Cc: Jarkko Sakkinen +Cc: Jeffrey E Altman +Cc: Wang Lei +Cc: Jeff Layton +Cc: Steve French +Cc: Marc Dionne +Cc: "David S. Miller" +Cc: Eric Dumazet +Cc: Jakub Kicinski +Cc: Paolo Abeni +Reviewed-by: Simon Horman +Signed-off-by: Linus Torvalds +Cc: Jeffrey E Altman +Signed-off-by: Greg Kroah-Hartman +--- + net/dns_resolver/dns_key.c | 19 +++++++++---------- + 1 file changed, 9 insertions(+), 10 deletions(-) + +--- a/net/dns_resolver/dns_key.c ++++ b/net/dns_resolver/dns_key.c +@@ -91,8 +91,6 @@ const struct cred *dns_resolver_cache; + static int + dns_resolver_preparse(struct key_preparsed_payload *prep) + { +- const struct dns_server_list_v1_header *v1; +- const struct dns_payload_header *bin; + struct user_key_payload *upayload; + unsigned long derrno; + int ret; +@@ -103,27 +101,28 @@ dns_resolver_preparse(struct key_prepars + return -EINVAL; + + if (data[0] == 0) { ++ const struct dns_server_list_v1_header *v1; ++ + /* It may be a server list. */ +- if (datalen <= sizeof(*bin)) ++ if (datalen <= sizeof(*v1)) + return -EINVAL; + +- bin = (const struct dns_payload_header *)data; +- kenter("[%u,%u],%u", bin->content, bin->version, datalen); +- if (bin->content != DNS_PAYLOAD_IS_SERVER_LIST) { ++ v1 = (const struct dns_server_list_v1_header *)data; ++ kenter("[%u,%u],%u", v1->hdr.content, v1->hdr.version, datalen); ++ if (v1->hdr.content != DNS_PAYLOAD_IS_SERVER_LIST) { + pr_warn_ratelimited( + "dns_resolver: Unsupported content type (%u)\n", +- bin->content); ++ v1->hdr.content); + return -EINVAL; + } + +- if (bin->version != 1) { ++ if (v1->hdr.version != 1) { + pr_warn_ratelimited( + "dns_resolver: Unsupported server list version (%u)\n", +- bin->version); ++ v1->hdr.version); + return -EINVAL; + } + +- v1 = (const struct dns_server_list_v1_header *)bin; + if ((v1->status != DNS_LOOKUP_GOOD && + v1->status != DNS_LOOKUP_GOOD_WITH_BAD)) { + if (prep->expiry == TIME64_MAX) diff --git a/queue-6.6/series b/queue-6.6/series new file mode 100644 index 00000000000..78e00459032 --- /dev/null +++ b/queue-6.6/series @@ -0,0 +1 @@ +keys-dns-fix-missing-size-check-of-v1-server-list-header.patch