diff options
| author | Eric Biggers <ebiggers@google.com> | 2017-10-09 12:46:18 -0700 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2017-10-27 10:23:18 +0200 |
| commit | 1dda04c761abf006402f7f5e9adb11f9044731c8 (patch) | |
| tree | eb12ca5d1222346129ae3491e50ae0d3cfe5de58 /fs | |
| parent | 7d9e13d953f2a3029d8b26a6f9a7dae83a4594ae (diff) | |
fscrypt: fix dereference of NULL user_key_payload
commit d60b5b7854c3d135b869f74fb93eaf63cbb1991a upstream.
When an fscrypt-encrypted file is opened, we request the file's master
key from the keyrings service as a logon key, then access its payload.
However, a revoked key has a NULL payload, and we failed to check for
this. request_key() *does* skip revoked keys, but there is still a
window where the key can be revoked before we acquire its semaphore.
Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.
Fixes: 88bd6ccdcdd6 ("ext4 crypto: add encryption key management facilities")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: <stable@vger.kernel.org> [v4.1+]
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/ext4/crypto_key.c | 6 | ||||
| -rw-r--r-- | fs/f2fs/crypto_key.c | 6 |
2 files changed, 12 insertions, 0 deletions
diff --git a/fs/ext4/crypto_key.c b/fs/ext4/crypto_key.c index 505f8afde57c..9a1bc638abce 100644 --- a/fs/ext4/crypto_key.c +++ b/fs/ext4/crypto_key.c @@ -204,6 +204,12 @@ int ext4_get_encryption_info(struct inode *inode) } down_read(&keyring_key->sem); ukp = user_key_payload(keyring_key); + if (!ukp) { + /* key was revoked before we acquired its semaphore */ + res = -EKEYREVOKED; + up_read(&keyring_key->sem); + goto out; + } if (ukp->datalen != sizeof(struct ext4_encryption_key)) { res = -EINVAL; up_read(&keyring_key->sem); diff --git a/fs/f2fs/crypto_key.c b/fs/f2fs/crypto_key.c index ae49be377b60..7e62889a1d3d 100644 --- a/fs/f2fs/crypto_key.c +++ b/fs/f2fs/crypto_key.c @@ -195,6 +195,12 @@ int f2fs_get_encryption_info(struct inode *inode) } down_read(&keyring_key->sem); ukp = user_key_payload(keyring_key); + if (!ukp) { + /* key was revoked before we acquired its semaphore */ + res = -EKEYREVOKED; + up_read(&keyring_key->sem); + goto out; + } if (ukp->datalen != sizeof(struct f2fs_encryption_key)) { res = -EINVAL; up_read(&keyring_key->sem); |