Commit 18c43e67 authored Oct 09, 2017 by Eric Biggers Committed by Greg Kroah-Hartman Nov 03, 2017

UPSTREAM: fscrypt: fix dereference of NULL user_key_payload



When an fscrypt-encrypted file is opened, we request the file's master
key from the keyrings service as a logon key, then access its payload.
However, a revoked key has a NULL payload, and we failed to check for
this.  request_key() *does* skip revoked keys, but there is still a
window where the key can be revoked before we acquire its semaphore.

Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.

Fixes: 88bd6ccdcdd6 ("ext4 crypto: add encryption key management facilities")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Cc: <stable@vger.kernel.org>    [v4.1+]
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
(cherry-picked from commit d60b5b7854c3d135b869f74fb93eaf63cbb1991a
 and fixed up for android-3.18)
Change-Id: I7522324dc41969b5401fbe88ff90b4cd1f049cf2
Signed-off-by: Eric Biggers <ebiggers@google.com>

parent 4a53a837

fs/crypto/keyinfo.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -122,6 +122,11 @@ static int validate_user_key(struct fscrypt_info *crypt_info,
		goto out;
		}
		ukp = user_key_payload(keyring_key);
		if (!ukp) {
		/* key was revoked before we acquired its semaphore */
		res = -EKEYREVOKED;
		goto out;
		}
		if (ukp->datalen != sizeof(struct fscrypt_key)) {
		res = -EINVAL;
		goto out;

fs/ext4/crypto_key.c

+6 −0

Original line number	Diff line number	Diff line
		@@ -204,6 +204,12 @@ int ext4_get_encryption_info(struct inode *inode)
		}
		down_read(&keyring_key->sem);
		ukp = ((struct user_key_payload *)keyring_key->payload.data);
		if (!ukp) {
		/* key was revoked before we acquired its semaphore */
		res = -EKEYREVOKED;
		up_read(&keyring_key->sem);
		goto out;
		}
		if (ukp->datalen != sizeof(struct ext4_encryption_key)) {
		res = -EINVAL;
		up_read(&keyring_key->sem);