From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
        id S1753937AbdJPPrj (ORCPT <rfc822;w@1wt.eu>);
        Mon, 16 Oct 2017 11:47:39 -0400
Received: from imap1.codethink.co.uk ([176.9.8.82]:54578 "EHLO
        imap1.codethink.co.uk" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1753208AbdJPPrh (ORCPT
        <rfc822;linux-kernel@vger.kernel.org>);
        Mon, 16 Oct 2017 11:47:37 -0400
Message-ID: <1508168854.22379.25.camel@codethink.co.uk>
Subject: Re: [PATCH 4.4 11/41] KEYS: fix writing past end of user-supplied
 buffer in keyring_read()
From: Ben Hutchings <ben.hutchings@codethink.co.uk>
To: Eric Biggers <ebiggers@google.com>,
        David Howells <dhowells@redhat.com>
Cc: stable@vger.kernel.org,
        Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
        linux-kernel@vger.kernel.org
Date: Mon, 16 Oct 2017 16:47:34 +0100
In-Reply-To: <20171003114220.627158480@linuxfoundation.org>
References: <20171003114219.900672076@linuxfoundation.org>
         <20171003114220.627158480@linuxfoundation.org>
Organization: Codethink Ltd.
Content-Type: text/plain; charset="UTF-8"
X-Mailer: Evolution 3.22.6-1+deb9u1 
Mime-Version: 1.0
Content-Transfer-Encoding: 8bit
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Tue, 2017-10-03 at 14:21 +0200, Greg Kroah-Hartman wrote:
> 4.4-stable review patch.  If anyone has any objections, please let me know.
> 
> ------------------
> 
> From: Eric Biggers <ebiggers@google.com>
> 
> commit e645016abc803dafc75e4b8f6e4118f088900ffb upstream.
> 
> Userspace can call keyctl_read() on a keyring to get the list of IDs of
> keys in the keyring.  But if the user-supplied buffer is too small, the
> kernel would write the full list anyway --- which will corrupt whatever
> userspace memory happened to be past the end of the buffer.  Fix it by
> only filling the space that is available.
[...]

trusted_read() has the same bug.

Also, the comment above keyctl_read_key() says "return the amount of
data that is available in the key, irrespective of how much we copied
into the buffer."  All the other implementations of key_type::read seem
to follow that, but this changes keyring_read() to return buflen in
case of a truncated read.

Ben.

-- 
Ben Hutchings
Software Developer, Codethink Ltd.