]> git.baikalelectronics.ru Git - kernel.git/commit
KEYS: trusted: fix writing past end of buffer in trusted_read()
authorEric Biggers <ebiggers@google.com>
Thu, 2 Nov 2017 00:47:12 +0000 (00:47 +0000)
committerJames Morris <james.l.morris@oracle.com>
Thu, 2 Nov 2017 09:58:07 +0000 (20:58 +1100)
commitf30558c018b8823af6d3a2c915f6cfa4858cd5d3
treea242e63ebea632ce64f1745703f43c0357b0c594
parent09f4274c4cc60d6f83a9ad9d2545bc5f663b179a
KEYS: trusted: fix writing past end of buffer in trusted_read()

When calling keyctl_read() on a key of type "trusted", if the
user-supplied buffer was too small, the kernel ignored the buffer length
and just wrote past the end of the buffer, potentially corrupting
userspace memory.  Fix it by instead returning the size required, as per
the documentation for keyctl_read().

We also don't even fill the buffer at all in this case, as this is
slightly easier to implement than doing a short read, and either
behavior appears to be permitted.  It also makes it match the behavior
of the "encrypted" key type.

Fixes: cd2dd61e808e ("keys: add new trusted key-type")
Reported-by: Ben Hutchings <ben@decadent.org.uk>
Cc: <stable@vger.kernel.org> # v2.6.38+
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
Reviewed-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
security/keys/trusted.c