From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-io0-f194.google.com ([209.85.223.194]:51136 "EHLO mail-io0-f194.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751396AbdJWXte (ORCPT ); Mon, 23 Oct 2017 19:49:34 -0400 Received: by mail-io0-f194.google.com with SMTP id 97so21964304iok.7 for ; Mon, 23 Oct 2017 16:49:34 -0700 (PDT) From: Eric Biggers To: stable@vger.kernel.org Cc: Eric Biggers , Mimi Zohar , David Safford , David Howells Subject: [PATCH] KEYS: encrypted: fix dereference of NULL user_key_payload Date: Mon, 23 Oct 2017 16:49:19 -0700 Message-Id: <20171023234919.85216-1-ebiggers3@gmail.com> Sender: stable-owner@vger.kernel.org List-ID: From: Eric Biggers commit 13923d0865ca96312197962522e88bc0aedccd74 upstream. Please apply to stable for 4.3 and earlier. A key of type "encrypted" references a "master key" which is used to encrypt and decrypt the encrypted key's payload. However, when we accessed the master key's payload, we failed to handle the case where the master key has been revoked, which sets the payload pointer to NULL. Note that request_key() *does* skip revoked keys, but there is still a window where the key can be revoked before we acquire its semaphore. Fix it by checking for a NULL payload, treating it like a key which was already revoked at the time it was requested. This was an issue for master keys of type "user" only. Master keys can also be of type "trusted", but those cannot be revoked. Fixes: 7e70cb497850 ("keys: add new key-type encrypted") Reviewed-by: James Morris Cc: [v2.6.38+] Cc: Mimi Zohar Cc: David Safford Signed-off-by: Eric Biggers Signed-off-by: David Howells --- security/keys/encrypted-keys/encrypted.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c index 8e1c0099bb66..89d5695c51cd 100644 --- a/security/keys/encrypted-keys/encrypted.c +++ b/security/keys/encrypted-keys/encrypted.c @@ -315,6 +315,13 @@ static struct key *request_user_key(const char *master_desc, u8 **master_key, down_read(&ukey->sem); upayload = ukey->payload.data; + if (!upayload) { + /* key was revoked before we acquired its semaphore */ + up_read(&ukey->sem); + key_put(ukey); + ukey = ERR_PTR(-EKEYREVOKED); + goto error; + } *master_key = upayload->data; *master_keylen = upayload->datalen; error: -- 2.15.0.rc0.271.g36b669edcc-goog