From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail-by2nam01on0114.outbound.protection.outlook.com ([104.47.34.114]:20358 "EHLO NAM01-BY2-obe.outbound.protection.outlook.com" rhost-flags-OK-OK-OK-FAIL) by vger.kernel.org with ESMTP id S1754974AbeARVCD (ORCPT ); Thu, 18 Jan 2018 16:02:03 -0500 From: Sasha Levin To: "stable@vger.kernel.org" , "stable-commits@vger.kernel.org" CC: Eric Biggers , David Howells , James Morris , Sasha Levin Subject: [added to the 4.1 stable tree] KEYS: fix dereferencing NULL payload with nonzero length Date: Thu, 18 Jan 2018 21:00:17 +0000 Message-ID: <20180118205908.3220-103-alexander.levin@microsoft.com> References: <20180118205908.3220-1-alexander.levin@microsoft.com> In-Reply-To: <20180118205908.3220-1-alexander.levin@microsoft.com> Content-Language: en-US Content-Type: text/plain; charset="iso-8859-1" Content-Transfer-Encoding: quoted-printable MIME-Version: 1.0 Sender: stable-owner@vger.kernel.org List-ID: From: Eric Biggers This patch has been added to the stable tree. If you have any objections, please let us know. =3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D=3D [ Upstream commit 5649645d725c73df4302428ee4e02c869248b4c5 ] sys_add_key() and the KEYCTL_UPDATE operation of sys_keyctl() allowed a NULL payload with nonzero length to be passed to the key type's ->preparse(), ->instantiate(), and/or ->update() methods. Various key types including asymmetric, cifs.idmap, cifs.spnego, and pkcs7_test did not handle this case, allowing an unprivileged user to trivially cause a NULL pointer dereference (kernel oops) if one of these key types was present. Fix it by doing the copy_from_user() when 'plen' is nonzero rather than when '_payload' is non-NULL, causing the syscall to fail with EFAULT as expected when an invalid buffer is specified. Cc: stable@vger.kernel.org # 2.6.10+ Signed-off-by: Eric Biggers Signed-off-by: David Howells Signed-off-by: James Morris Signed-off-by: Sasha Levin --- security/keys/keyctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c index a2d29cca16c6..c804189d0d03 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c @@ -99,7 +99,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type, payload =3D NULL; =20 vm =3D false; - if (_payload) { + if (plen) { ret =3D -ENOMEM; payload =3D kmalloc(plen, GFP_KERNEL | __GFP_NOWARN); if (!payload) { @@ -333,7 +333,7 @@ long keyctl_update_key(key_serial_t id, =20 /* pull the payload in if one was supplied */ payload =3D NULL; - if (_payload) { + if (plen) { ret =3D -ENOMEM; payload =3D kmalloc(plen, GFP_KERNEL); if (!payload) --=20 2.11.0