Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

KEYS: encrypted: fix dereference of NULL user_key_payload 

commit 13923d0865ca96312197962522e88bc0aedccd74 upstream.

A key of type "encrypted" references a "master key" which is used to
encrypt and decrypt the encrypted key's payload.  However, when we
accessed the master key's payload, we failed to handle the case where
the master key has been revoked, which sets the payload pointer to NULL.
Note that request_key() *does* skip revoked keys, but there is still a
window where the key can be revoked before we acquire its semaphore.

Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.

This was an issue for master keys of type "user" only.  Master keys can
also be of type "trusted", but those cannot be revoked.

Fixes: 7e70cb4978 ("keys: add new key-type encrypted")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: <stable@vger.kernel.org>    [v2.6.38+]
Cc: Mimi Zohar <zohar@linux.vnet.ibm.com>
Cc: David Safford <safford@us.ibm.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>
This commit is contained in:
Eric Biggers 2017-10-09 12:37:49 -07:00 committed by syphyr
parent 2821e7ab21
commit 50ca731a7d
1 changed files with 7 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
security/keys/encrypted-keys/encrypted.c
View File

@ -314,6 +314,13 @@ static struct key *request_user_key(const char *master_desc, u8 **master_key,
down_read(&ukey->sem);
upayload = ukey->payload.data;
if (!upayload) {
/* key was revoked before we acquired its semaphore */
up_read(&ukey->sem);
key_put(ukey);
ukey = ERR_PTR(-EKEYREVOKED);
goto error;
}
*master_key = upayload->data;
*master_keylen = upayload->datalen;
error: