Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1751914AbdDANWs (ORCPT ); Sat, 1 Apr 2017 09:22:48 -0400 Received: from shadbolt.e.decadent.org.uk ([88.96.1.126]:36142 "EHLO shadbolt.e.decadent.org.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751861AbdDANWn (ORCPT ); Sat, 1 Apr 2017 09:22:43 -0400 Content-Type: text/plain; charset="UTF-8" Content-Disposition: inline Content-Transfer-Encoding: 8bit MIME-Version: 1.0 From: Ben Hutchings To: linux-kernel@vger.kernel.org, stable@vger.kernel.org CC: akpm@linux-foundation.org, "David Howells" , "idl3r" , "Andrey Ryabinin" , "Igor Redko" Date: Sat, 01 Apr 2017 14:17:50 +0100 Message-ID: X-Mailer: LinuxStableQueue (scripts by bwh) Subject: [PATCH 3.16 19/19] keys: Guard against null match function in keyring_search_aux() In-Reply-To: X-SA-Exim-Connect-IP: 2a02:8011:400e:2:6f00:88c8:c921:d332 X-SA-Exim-Mail-From: ben@decadent.org.uk X-SA-Exim-Scanned: No (on shadbolt.decadent.org.uk); SAEximRunCond expanded to false Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1571 Lines: 49 3.16.43-rc1 review patch. If anyone has any objections, please let me know. ------------------ From: Ben Hutchings The "dead" key type has no match operation, and a search for keys of this type can cause a null dereference in keyring_search_iterator(). keyring_search() has a check for this, but request_keyring_and_link() does not. Move the check into keyring_search_aux(), covering both of them. This was fixed upstream by commit c06cfb08b88d ("KEYS: Remove key_type::match in favour of overriding default by match_preparse"), part of a series of large changes that are not suitable for backporting. CVE-2017-2647 / CVE-2017-6951 Reported-by: Igor Redko Reported-by: Andrey Ryabinin References: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2017-2647 Reported-by: idl3r References: https://www.spinics.net/lists/keyrings/msg01845.html Signed-off-by: Ben Hutchings Cc: David Howells --- --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -848,6 +848,9 @@ key_ref_t keyring_search_aux(key_ref_t k return ERR_PTR(err); } + if (!ctx->match) + return ERR_PTR(-ENOKEY); + rcu_read_lock(); ctx->now = current_kernel_time(); if (search_nested_keyrings(keyring, ctx)) @@ -879,9 +882,6 @@ key_ref_t keyring_search(key_ref_t keyri KEYRING_SEARCH_DO_STATE_CHECK), }; - if (!ctx.match) - return ERR_PTR(-ENOKEY); - return keyring_search_aux(keyring, &ctx); } EXPORT_SYMBOL(keyring_search);