[PATCH] platform: cznic: avoid slab-out-of-bounds write on short Turris key reads

[PATCH] platform: cznic: avoid slab-out-of-bounds write on short Turris key reads

[Junyoung Jang]

For 0 < buflen <= PAGE_SIZE, keyctl_read_key() allocates a temporary
kernel buffer of size buflen via kvmalloc() and passes it to the key
type's .read() callback. Only after the callback returns does it check
whether the returned required length exceeds buflen.

turris_signing_key_read() clamps buflen when it exceeds
subtype->public_key_size, but ignores the clamped value and
unconditionally passes subtype->public_key_size (33 or 67 bytes) to
memcpy(). As a result, calling KEYCTL_READ with a smaller non-zero
buffer (e.g., buflen=1) writes past the end of the temporary buffer,
triggering a kernel heap slab-out-of-bounds write.

Per the key_type .read() contract, only copy the public key when the
supplied buffer is large enough to hold it, and always return the
required size.

Fixes: 0b28b7080ef5 ("platform: cznic: Add keyctl helpers for Turris platform")
Signed-off-by: Junyoung Jang <graypanda.inzag@gmail.com>
---
 drivers/platform/cznic/turris-signing-key.c | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/drivers/platform/cznic/turris-signing-key.c b/drivers/platform/cznic/turris-signing-key.c
index 3827178565e2..af414e236de2 100644
--- a/drivers/platform/cznic/turris-signing-key.c
+++ b/drivers/platform/cznic/turris-signing-key.c
@@ -46,12 +46,8 @@ static long turris_signing_key_read(const struct key *key, char *buffer, size_t
 	if (!subtype)
 		return -EIO;
 
-	if (buffer) {
-		if (buflen > subtype->public_key_size)
-			buflen = subtype->public_key_size;
-
+	if (buffer && buflen >= subtype->public_key_size)
 		memcpy(buffer, subtype->get_public_key(key), subtype->public_key_size);
-	}
 
 	return subtype->public_key_size;
 }
-- 
2.43.0