]> git.baikalelectronics.ru Git - kernel.git/commit
KEYS: encrypted: fix dereference of NULL user_key_payload
authorEric Biggers <ebiggers@google.com>
Mon, 9 Oct 2017 19:37:49 +0000 (12:37 -0700)
committerDavid Howells <dhowells@redhat.com>
Thu, 12 Oct 2017 14:55:09 +0000 (15:55 +0100)
commit4454ba0b37d2349c0d8856626d5700f6776b451f
treebf7441d098bd2f41ca7f2fa92010d6b59291b548
parent3fb5e40d11aacb853b61d450dad9651aef613f01
KEYS: encrypted: fix dereference of NULL user_key_payload

A key of type "encrypted" references a "master key" which is used to
encrypt and decrypt the encrypted key's payload.  However, when we
accessed the master key's payload, we failed to handle the case where
the master key has been revoked, which sets the payload pointer to NULL.
Note that request_key() *does* skip revoked keys, but there is still a
window where the key can be revoked before we acquire its semaphore.

Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.

This was an issue for master keys of type "user" only.  Master keys can
also be of type "trusted", but those cannot be revoked.

Fixes: 94ef37d63bd2 ("keys: add new key-type encrypted")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: <stable@vger.kernel.org> [v2.6.38+]
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: David Safford <safford@us.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
security/keys/encrypted-keys/encrypted.c