From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752290AbdJSP1c convert rfc822-to-8bit (ORCPT ); Thu, 19 Oct 2017 11:27:32 -0400 Received: from mx1.redhat.com ([209.132.183.28]:36442 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751244AbdJSP1a (ORCPT ); Thu, 19 Oct 2017 11:27:30 -0400 DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 43745C047B99 Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx07.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=dhowells@redhat.com Organization: Red Hat UK Ltd. Registered Address: Red Hat UK Ltd, Amberley Place, 107-111 Peascod Street, Windsor, Berkshire, SI4 1TE, United Kingdom. Registered in England and Wales under Company Registration No. 3798903 From: David Howells In-Reply-To: <20171016181206.GC121701@google.com> References: <20171016181206.GC121701@google.com> <20171003114219.900672076@linuxfoundation.org> <20171003114220.627158480@linuxfoundation.org> <1508168854.22379.25.camel@codethink.co.uk> To: Eric Biggers Cc: dhowells@redhat.com, Ben Hutchings , stable@vger.kernel.org, Greg Kroah-Hartman , linux-kernel@vger.kernel.org Subject: Re: [PATCH 4.4 11/41] KEYS: fix writing past end of user-supplied buffer in keyring_read() MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-ID: <10707.1508426843.1@warthog.procyon.org.uk> Content-Transfer-Encoding: 8BIT Date: Thu, 19 Oct 2017 16:27:23 +0100 Message-ID: <10708.1508426843@warthog.procyon.org.uk> X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.31]); Thu, 19 Oct 2017 15:27:30 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Eric Biggers wrote: > Hi Ben, thanks for pointing this out. I had assumed the "obvious" semantics, > but it turns out that's not what's documented. The manpage is correct. keyctl_read_alloc() in libkeyutils relies on the behaviour documented there with respect to the full size of the data always being returned, even if the buffer was too small. The keyring cannot be modified whilst it is being read, so that's not a concern. keyctl_read_alloc() doesn't care if the buffer actually gets written to or not, but it's best to honour the manpage. David