Skip to contentSkip to conversation

fscrypt: fix dereference of NULL user_key_payload

PATCH Applied Eric Biggers 2 participants 4 messages Oct 9, 2017 – Oct 31, 2017

Subsystems (4)
Stable branch Security (LSM) Keys/keyrings fscrypt: file system level encryption support
lore
Share & tools
lore

Eric Biggers

author
#0 lore raw

PATCH v2 1/1 fscrypt: fix dereference of NULL user_key_payload

From: Eric Biggers <[email protected]>

When an fscrypt-encrypted file is opened, we request the file's master key from the keyrings service as a logon key, then access its payload. However, a revoked key has a NULL payload, and we failed to check for this. request_key() *does* skip revoked keys, but there is still a window where the key can be revoked before we acquire its semaphore.

Fix it by checking for a NULL payload, treating it like a key which was already revoked at the time it was requested.

Fixes 88bd6ccdcdd6 ("ext4 crypto: add encryption key management facilities")
Reviewed-by James Morris <[email protected]>
Cc <[email protected]> [v4.1+]
Signed-off-by Eric Biggers <[email protected]>

---

Changed since v1: added Reviewed-by and resent as standalone patch. Can this please be taken through the fscrypt tree?

 fs/crypto/keyinfo.c | 5 +++++
 1 file changed, 5 insertions(+)
fs/crypto/keyinfo.c +5 -0
index 018c588c7ac3..8e704d12a1cf 100644
@@ -109,6 +109,11 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
 		goto out;
 	}
 	ukp = user_key_payload_locked(keyring_key);
+	if (!ukp) {
+		/* key was revoked before we acquired its semaphore */
+		res = -EKEYREVOKED;
+		goto out;
+	}
 	if (ukp->datalen != sizeof(struct fscrypt_key)) {
 		res = -EINVAL;
 		goto out;
Signature · 1 line
2.14.2.920.gcf0c67979c-goog
maintainer Applied
#1 lore raw
Quoted 8 lines · Eric Biggers

From: Eric Biggers <[email protected]>

When an fscrypt-encrypted file is opened, we request the file's master key from the keyrings service as a logon key, then access its payload. However, a revoked key has a NULL payload, and we failed to check for this. request_key() *does* skip revoked keys, but there is still a window where the key can be revoked before we acquire its semaphore.

Quoted 7 lines

Fix it by checking for a NULL payload, treating it like a key which was already revoked at the time it was requested.

Fixes 88bd6ccdcdd6 ("ext4 crypto: add encryption key management facilities")
Reviewed-by James Morris <[email protected]>
Cc <[email protected]> [v4.1+]
Signed-off-by Eric Biggers <[email protected]>

Applied, thanks.

- Ted

author
#2 lore raw
Quoted 12 lines · Theodore Ts'o
Quoted 11 lines · Eric Biggers

From: Eric Biggers <[email protected]>

When an fscrypt-encrypted file is opened, we request the file's master key from the keyrings service as a logon key, then access its payload. However, a revoked key has a NULL payload, and we failed to check for this. request_key() *does* skip revoked keys, but there is still a window where the key can be revoked before we acquire its semaphore.

Fix it by checking for a NULL payload, treating it like a key which was already revoked at the time it was requested.

Quoted 7 lines
Quoted 4 lines
Fixes 88bd6ccdcdd6 ("ext4 crypto: add encryption key management facilities")
Reviewed-by James Morris <[email protected]>
Cc <[email protected]> [v4.1+]
Signed-off-by Eric Biggers <[email protected]>

Applied, thanks.

Hi Ted, you should drop this one, since it's already in mainline; David Howells ended up taking the original series via the keyrings tree.

Thanks!

Eric

maintainer
#3 lore raw
Quoted 3 lines · Eric Biggers

Hi Ted, you should drop this one, since it's already in mainline; David Howells ended up taking the original series via the keyrings tree.

Ah, I see it landed in v4.14-rc6. I'll drop it from the fscrypt tree.

- Ted