From: Waiman Long <longman@redhat.com> To: David Howells <dhowells@redhat.com>, Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>, James Morris <jmorris@namei.org>, "Serge E. Hallyn" <serge@hallyn.com>, Mimi Zohar <zohar@linux.ibm.com>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org> Cc: keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, netdev@vger.kernel.org, linux-afs@lists.infradead.org, Sumit Garg <sumit.garg@linaro.org>, Jerry Snitselaar <jsnitsel@redhat.com>, Roberto Sassu <roberto.sassu@huawei.com>, Eric Biggers <ebiggers@google.com>, Chris von Recklinghausen <crecklin@redhat.com>, Waiman Long <longman@redhat.com> Subject: [PATCH v5 0/2] KEYS: Read keys to internal buffer & then copy to userspace Date: Wed, 18 Mar 2020 22:14:55 +0000 [thread overview] Message-ID: <20200318221457.1330-1-longman@redhat.com> (raw) v5: - Merge v4 patches 2 and 3 into 1 to avoid sparse warning. Merge some of commit logs into patch 1 as well. There is no further change. v4: - Remove the __user annotation from big_key_read() and user_read() in patch 1. - Add a new patch 2 to remove __user annotation from rxrpc_read(). - Add a new patch 3 to remove __user annotation from dns_resolver_read(). - Merge the original patches 2 and 3 into a single patch 4 and refactor it as suggested by Jarkko and Eric. v3: - Reorganize the keyctl_read_key() code to make it more readable as suggested by Jarkko Sakkinen. - Add patch 3 to use kvmalloc() for safer large buffer allocation as suggested by David Howells. v2: - Handle NULL buffer and buflen properly in patch 1. - Fix a bug in big_key.c. - Add patch 2 to handle arbitrary large user-supplied buflen. The current security key read methods are called with the key semaphore held. The methods then copy out the key data to userspace which is subjected to page fault and may acquire the mmap semaphore. That can result in circular lock dependency and hence a chance to get into deadlock. To avoid such a deadlock, an internal buffer is now allocated for getting out the necessary data first. After releasing the key semaphore, the key data are then copied out to userspace sidestepping the circular lock dependency. The keyutils test suite was run and the test passed with these patchset applied without any falure. Waiman Long (2): KEYS: Don't write out to userspace while holding key semaphore KEYS: Avoid false positive ENOMEM error on key read include/keys/big_key-type.h | 2 +- include/keys/user-type.h | 3 +- include/linux/key-type.h | 2 +- net/dns_resolver/dns_key.c | 2 +- net/rxrpc/key.c | 27 +++---- security/keys/big_key.c | 11 ++- security/keys/encrypted-keys/encrypted.c | 7 +- security/keys/internal.h | 12 ++++ security/keys/keyctl.c | 86 ++++++++++++++++++++--- security/keys/keyring.c | 6 +- security/keys/request_key_auth.c | 7 +- security/keys/trusted-keys/trusted_tpm1.c | 14 +--- security/keys/user_defined.c | 5 +- 13 files changed, 116 insertions(+), 68 deletions(-) -- 2.18.1
WARNING: multiple messages have this Message-ID (diff)
From: Waiman Long <longman@redhat.com> To: David Howells <dhowells@redhat.com>, Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>, James Morris <jmorris@namei.org>, "Serge E. Hallyn" <serge@hallyn.com>, Mimi Zohar <zohar@linux.ibm.com>, "David S. Miller" <davem@davemloft.net>, Jakub Kicinski <kuba@kernel.org> Cc: keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, netdev@vger.kernel.org, linux-afs@lists.infradead.org, Sumit Garg <sumit.garg@linaro.org>, Jerry Snitselaar <jsnitsel@redhat.com>, Roberto Sassu <roberto.sassu@huawei.com>, Eric Biggers <ebiggers@google.com>, Chris von Recklinghausen <crecklin@redhat.com>, Waiman Long <longman@redhat.com> Subject: [PATCH v5 0/2] KEYS: Read keys to internal buffer & then copy to userspace Date: Wed, 18 Mar 2020 18:14:55 -0400 [thread overview] Message-ID: <20200318221457.1330-1-longman@redhat.com> (raw) v5: - Merge v4 patches 2 and 3 into 1 to avoid sparse warning. Merge some of commit logs into patch 1 as well. There is no further change. v4: - Remove the __user annotation from big_key_read() and user_read() in patch 1. - Add a new patch 2 to remove __user annotation from rxrpc_read(). - Add a new patch 3 to remove __user annotation from dns_resolver_read(). - Merge the original patches 2 and 3 into a single patch 4 and refactor it as suggested by Jarkko and Eric. v3: - Reorganize the keyctl_read_key() code to make it more readable as suggested by Jarkko Sakkinen. - Add patch 3 to use kvmalloc() for safer large buffer allocation as suggested by David Howells. v2: - Handle NULL buffer and buflen properly in patch 1. - Fix a bug in big_key.c. - Add patch 2 to handle arbitrary large user-supplied buflen. The current security key read methods are called with the key semaphore held. The methods then copy out the key data to userspace which is subjected to page fault and may acquire the mmap semaphore. That can result in circular lock dependency and hence a chance to get into deadlock. To avoid such a deadlock, an internal buffer is now allocated for getting out the necessary data first. After releasing the key semaphore, the key data are then copied out to userspace sidestepping the circular lock dependency. The keyutils test suite was run and the test passed with these patchset applied without any falure. Waiman Long (2): KEYS: Don't write out to userspace while holding key semaphore KEYS: Avoid false positive ENOMEM error on key read include/keys/big_key-type.h | 2 +- include/keys/user-type.h | 3 +- include/linux/key-type.h | 2 +- net/dns_resolver/dns_key.c | 2 +- net/rxrpc/key.c | 27 +++---- security/keys/big_key.c | 11 ++- security/keys/encrypted-keys/encrypted.c | 7 +- security/keys/internal.h | 12 ++++ security/keys/keyctl.c | 86 ++++++++++++++++++++--- security/keys/keyring.c | 6 +- security/keys/request_key_auth.c | 7 +- security/keys/trusted-keys/trusted_tpm1.c | 14 +--- security/keys/user_defined.c | 5 +- 13 files changed, 116 insertions(+), 68 deletions(-) -- 2.18.1
next reply other threads:[~2020-03-18 22:14 UTC|newest] Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-03-18 22:14 Waiman Long [this message] 2020-03-18 22:14 ` [PATCH v5 0/2] KEYS: Read keys to internal buffer & then copy to userspace Waiman Long 2020-03-18 22:14 ` [PATCH v5 1/2] KEYS: Don't write out to userspace while holding key semaphore Waiman Long 2020-03-18 22:14 ` Waiman Long 2020-03-18 22:14 ` [PATCH v5 2/2] KEYS: Avoid false positive ENOMEM error on key read Waiman Long 2020-03-18 22:14 ` Waiman Long 2020-03-19 19:46 ` Jarkko Sakkinen 2020-03-19 19:46 ` Jarkko Sakkinen 2020-03-20 0:07 ` Waiman Long 2020-03-20 0:07 ` Waiman Long 2020-03-20 2:07 ` Jarkko Sakkinen 2020-03-20 2:07 ` Jarkko Sakkinen 2020-03-20 13:27 ` Waiman Long 2020-03-20 13:27 ` Waiman Long 2020-03-20 14:35 ` Jarkko Sakkinen 2020-03-20 14:35 ` Jarkko Sakkinen 2020-03-20 15:09 ` Waiman Long 2020-03-20 15:09 ` Waiman Long 2020-03-20 23:55 ` David Howells 2020-03-21 0:58 ` Jarkko Sakkinen 2020-03-21 0:58 ` Jarkko Sakkinen 2020-03-20 8:20 ` [PATCH v5 1/2] KEYS: Don't write out to userspace while holding key semaphore David Howells 2020-03-20 13:56 ` Waiman Long 2020-03-20 13:56 ` Waiman Long
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200318221457.1330-1-longman@redhat.com \ --to=longman@redhat.com \ --cc=crecklin@redhat.com \ --cc=davem@davemloft.net \ --cc=dhowells@redhat.com \ --cc=ebiggers@google.com \ --cc=jarkko.sakkinen@linux.intel.com \ --cc=jmorris@namei.org \ --cc=jsnitsel@redhat.com \ --cc=keyrings@vger.kernel.org \ --cc=kuba@kernel.org \ --cc=linux-afs@lists.infradead.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=netdev@vger.kernel.org \ --cc=roberto.sassu@huawei.com \ --cc=serge@hallyn.com \ --cc=sumit.garg@linaro.org \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.