Received-SPF: pass (google.com: domain of linux-nfs+bounces-1008-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45d1:ec00::1 as permitted sender) client-ip=2604:1380:45d1:ec00::1;
Date: Wed, 10 Jan 2024 19:06:24 +0800
From: Pengfei Xu <pengfei.xu@intel.com>
To: David Howells <dhowells@redhat.com>
CC: <eadavis@qq.com>, Linus Torvalds <torvalds@linux-foundation.org>, "Simon
 Horman" <horms@kernel.org>, Markus Suvanto <markus.suvanto@gmail.com>,
	"Jeffrey E Altman" <jaltman@auristor.com>, Marc Dionne
	<marc.dionne@auristor.com>, "Wang Lei" <wang840925@gmail.com>, Jeff Layton
	<jlayton@redhat.com>, Steve French <smfrench@gmail.com>, Jarkko Sakkinen
	<jarkko@kernel.org>, "David S. Miller" <davem@davemloft.net>, Eric Dumazet
	<edumazet@google.com>, Jakub Kicinski <kuba@kernel.org>, Paolo Abeni
	<pabeni@redhat.com>, <linux-afs@lists.infradead.org>,
	<keyrings@vger.kernel.org>, <linux-cifs@vger.kernel.org>,
	<linux-nfs@vger.kernel.org>, <ceph-devel@vger.kernel.org>,
	<netdev@vger.kernel.org>, <linux-fsdevel@vger.kernel.org>,
	<linux-kernel@vger.kernel.org>, <heng.su@intel.com>
Subject: Re: [PATCH] keys, dns: Fix missing size check of V1 server-list
 header
Message-ID: <ZZ56MMinZLrmF9Z+@xpf.sh.intel.com>
References: <ZZ4fyY4r3rqgZL+4@xpf.sh.intel.com>
 <CAHk-=wgJz36ZE66_8gXjP_TofkkugXBZEpTr_Dtc_JANsH1SEw@mail.gmail.com>
 <1843374.1703172614@warthog.procyon.org.uk>
 <20231223172858.GI201037@kernel.org>
 <2592945.1703376169@warthog.procyon.org.uk>
 <1694631.1704881668@warthog.procyon.org.uk>
Content-Type: text/plain; charset="us-ascii"
Content-Disposition: inline
In-Reply-To: <1694631.1704881668@warthog.procyon.org.uk>
Precedence: bulk
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?pSA+tKUdo5oJOJnXYrBvGcvjoaNJVOMXP30QCjoc1BxO9G2JNJ/QHNh35Jpu?=
 =?us-ascii?Q?SB4NuCqupUjQnotm0LEQZkPilMK7poFBRzEh3i4wJmq0G5msqvbk94VbbinK?=
 =?us-ascii?Q?txRYXnkA+zrTjWr5wxmoQN+e1dEjdA+BQrm8CNGUMfZnKAuvTMYQlyU5nBC4?=
 =?us-ascii?Q?rRWbSU8tJiVATg0b2gL246E0KRKJnTfAhlwBu7V6wpd1cPetyB7//AFSAG/i?=
 =?us-ascii?Q?fg3byOdqQTMXsre7zhNCNeyqXODVIal2F1sdBVyWgWKa49CDRS7tK5KRHVbS?=
 =?us-ascii?Q?gcKGy4Ej+vwyBEZiaAUSyQY4O/a/QGqHn4TYKnG800zNsdp4DkbImWYWakQh?=
 =?us-ascii?Q?EndA6x32qokPq+6mK88YoEjFbBtkzdzycL9y+a3HSVXuXlZmBClQVrJmIg2i?=
 =?us-ascii?Q?HmWG8FejQYy7Pc5qa3gumtEGwnImphU3QPQT0obxl3jgMZPOV+0g0F4Lp1Vl?=
 =?us-ascii?Q?4HxuN/7pNoeZyzDS6WOklBf/YjcsXjtBpm0gPx3tZChDptGR5T6E2eQvqX4I?=
 =?us-ascii?Q?WTFNsvz4VrmUo+slfmH9pZ/T7xDXKOlk8HNMqVULBFBOU7p5X1nCN1eZ2WY9?=
 =?us-ascii?Q?KBBIzqN50rSZrSn3BeSCOOg8NeVcfiRiAyYRuSnCTOFLQOYCaKMyRrzhNuPc?=
 =?us-ascii?Q?WQ/WbpDmVGJTPoHivepgtiM4PdCa2xZOiMZ5Usacsg0cR8gidASXdHvZ2cnw?=
 =?us-ascii?Q?amiZOFjgP4QWHl9StXbUO3X0+S5OsSH8kT1APlenU66ETP1KT2zjzvmuqeaB?=
 =?us-ascii?Q?P08E8ONTTpPMwifgLvWpid0B4ODJSo6sD5XtMfLHJGsJPDbvJCGk5CFZVInG?=
 =?us-ascii?Q?HJWveED2jJjGq4Hr9XqcWLUq12yUm925KBCw/6Xp08tvtGRwtD/oCYVdX2wL?=
 =?us-ascii?Q?5A6zu9TxIquKktdVSdAdqKaueOcVEENnFP1luD1w2b5QHgDbOoWkUJWRmSWX?=
 =?us-ascii?Q?3iIOTbQc6cbIg+CfXnrxl+D+npZiRtKU6SkjPDIyectDsfwVkxm0jmuGYTlf?=
 =?us-ascii?Q?opIlwsoxq4fAT0xs1EPjXQujDgrWKVTvmJrRcZ47F2A5dK73FJ9Hz99xVR5U?=
 =?us-ascii?Q?o8vjjJ4Pjyj9F0knsJ9GgsQsoePCmA42kPR8pfP1F+MTrMT3GabVf874if+B?=
 =?us-ascii?Q?IdORnEaJ5IeQnEV9fALk5QoUK9OegUZgFZEL2jQjaXJtwtSoytZKyA1OVdTl?=
 =?us-ascii?Q?A3Y7EEdeTHWAZ6vA4RvrPPOJ13STNUXhUzwQ//vsg+notyx1pfeXYY8DGLPN?=
 =?us-ascii?Q?x4/30fmnEtF75wo7Yea/zdSlfR89EbJ3LHkifCX9E4SvlEkQwHxf/zhFOb+T?=
 =?us-ascii?Q?5caFAW+tbKnhyaDgUAJQnlJb38voVxOS+ELtt2+S+4aJMLosvMLECSGynLzx?=
 =?us-ascii?Q?D4fdQAZsEa72dGGME1epMYpxU9mH5/sN1yxDKcMM4OcSAoPKrizfnz2f6fx0?=
 =?us-ascii?Q?pFXoQpn+0rpU2GMkoUBjwKKzQTWY6alk+Y9OhgLzAfjy3OwU/er8M7VrKvGx?=
 =?us-ascii?Q?86eAQ/Th0l6KeirD3NT8KNvgUgm4kXoaFdtAU6j5q5QDxxfpXXCy7XJmkBqS?=
 =?us-ascii?Q?Ey53cNfFUmHszCNkZ+UxWhU3DI+FnVQpyKVh1bd/?=
X-MS-Exchange-CrossTenant-Network-Message-Id: 408fe738-c9f7-41b7-146b-08dc11ccf63f
X-MS-Exchange-CrossTenant-AuthSource: PH0PR11MB4839.namprd11.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 10 Jan 2024 11:11:58.3387
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 46c98d88-e344-4ed4-8496-4ed7712e255d
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: NwbnswRQ0J/gS+aFFvzmEg8m25qbSK7R9hN2vcD8CIVAoS2I/X+x10iNW+anHuEMCrKIaI9sJ5OSc+g/9ID+zQ==
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SA0PR11MB4768
X-OriginatorOrg: intel.com

On 2024-01-10 at 10:14:28 +0000, David Howells wrote:
> Pengfei Xu <pengfei.xu@intel.com> wrote:
> 
> >   Bisected info between v6.7-rc7(keyctl05 passed) and v6.7-rc8(keyctl05 failed)
> > is in attached.
> > 
> > keyctl05 failed in add_key with type "dns_resolver" syscall step tracked
> > by strace:
> > "
> > [pid 863107] add_key("dns_resolver", "desc", "\0\0\1\377\0", 5, KEY_SPEC_SESSION_KEYRING <unfinished ...>
> > [pid 863106] <... alarm resumed>)       = 30
> > [pid 863107] <... add_key resumed>)     = -1 EINVAL (Invalid argument)
> > "
> 
> It should fail as the payload is actually invalid.  The payload specifies a
> version 1 format - and that requires a 6-byte header.  The bug the patched
> fixes is that whilst there is a length check for the basic 3-byte header,
> there was no length check for the extended v1 header.

Thanks for description!

> 
> > After increased the dns_res_payload to 7 bytes(6 bytes was still failed),
> 
> The following doesn't work for you?
> 
> 	echo -n -e '\0\0\01\xff\0\0' | keyctl padd dns_resolver desc @p

I tried as follows, 6 bytes failed and 7 bytes passed:
"
# echo -n -e '\0\0\01\xff\0\0' | keyctl padd dns_resolver desc @p
add_key: Invalid argument
# echo -n -e '\0\0\01\xff\0\0\0' | keyctl padd dns_resolver desc @p
74678921
# uname -r
6.7.0-rc8
"

Thanks!

> 
> David
>