From mboxrd@z Thu Jan 1 00:00:00 1970 From: Waiman Long Date: Wed, 18 Mar 2020 22:14:55 +0000 Subject: [PATCH v5 0/2] KEYS: Read keys to internal buffer & then copy to userspace Message-Id: <20200318221457.1330-1-longman@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit List-Id: To: David Howells , Jarkko Sakkinen , James Morris , "Serge E. Hallyn" , Mimi Zohar , "David S. Miller" , Jakub Kicinski Cc: keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, netdev@vger.kernel.org, linux-afs@lists.infradead.org, Sumit Garg , Jerry Snitselaar , Roberto Sassu , Eric Biggers , Chris von Recklinghausen , Waiman Long v5: - Merge v4 patches 2 and 3 into 1 to avoid sparse warning. Merge some of commit logs into patch 1 as well. There is no further change. v4: - Remove the __user annotation from big_key_read() and user_read() in patch 1. - Add a new patch 2 to remove __user annotation from rxrpc_read(). - Add a new patch 3 to remove __user annotation from dns_resolver_read(). - Merge the original patches 2 and 3 into a single patch 4 and refactor it as suggested by Jarkko and Eric. v3: - Reorganize the keyctl_read_key() code to make it more readable as suggested by Jarkko Sakkinen. - Add patch 3 to use kvmalloc() for safer large buffer allocation as suggested by David Howells. v2: - Handle NULL buffer and buflen properly in patch 1. - Fix a bug in big_key.c. - Add patch 2 to handle arbitrary large user-supplied buflen. The current security key read methods are called with the key semaphore held. The methods then copy out the key data to userspace which is subjected to page fault and may acquire the mmap semaphore. That can result in circular lock dependency and hence a chance to get into deadlock. To avoid such a deadlock, an internal buffer is now allocated for getting out the necessary data first. After releasing the key semaphore, the key data are then copied out to userspace sidestepping the circular lock dependency. The keyutils test suite was run and the test passed with these patchset applied without any falure. Waiman Long (2): KEYS: Don't write out to userspace while holding key semaphore KEYS: Avoid false positive ENOMEM error on key read include/keys/big_key-type.h | 2 +- include/keys/user-type.h | 3 +- include/linux/key-type.h | 2 +- net/dns_resolver/dns_key.c | 2 +- net/rxrpc/key.c | 27 +++---- security/keys/big_key.c | 11 ++- security/keys/encrypted-keys/encrypted.c | 7 +- security/keys/internal.h | 12 ++++ security/keys/keyctl.c | 86 ++++++++++++++++++++--- security/keys/keyring.c | 6 +- security/keys/request_key_auth.c | 7 +- security/keys/trusted-keys/trusted_tpm1.c | 14 +--- security/keys/user_defined.c | 5 +- 13 files changed, 116 insertions(+), 68 deletions(-) -- 2.18.1 From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-0.9 required=3.0 tests=DKIMWL_WL_HIGH,DKIM_SIGNED, DKIM_VALID,DKIM_VALID_AU,HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI, SPF_HELO_NONE,SPF_PASS autolearn=no autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6862DC4332E for ; Wed, 18 Mar 2020 22:15:27 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 3B7332076C for ; Wed, 18 Mar 2020 22:15:27 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="H5KkmFXH" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1727425AbgCRWPZ (ORCPT ); Wed, 18 Mar 2020 18:15:25 -0400 Received: from us-smtp-delivery-74.mimecast.com ([63.128.21.74]:29835 "EHLO us-smtp-delivery-74.mimecast.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1727345AbgCRWPU (ORCPT ); Wed, 18 Mar 2020 18:15:20 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1584569719; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc; bh=hYdi6uEYaESn05W64BXYLKDVbVzJzJ2IM2CBIwZRtco=; b=H5KkmFXH6n/KESxx/sZBrU4gcjySDQfeNJhO9fbFb6F3s9HqWD6xgEoxpX1trswtThYM1y Hx9X+11LeaGF44iGjqAwjVfafRvNAd22vL0KmhyLV+hAHSw9MiqU6YloEKxOcLmQcw9CQ5 rNFf5aI7DIFwHwA5TAE0wRcyEO+cGUw= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-444-s6cnxxpyMqWS4UM_YEYicw-1; Wed, 18 Mar 2020 18:15:15 -0400 X-MC-Unique: s6cnxxpyMqWS4UM_YEYicw-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 9502E13F8; Wed, 18 Mar 2020 22:15:10 +0000 (UTC) Received: from llong.com (ovpn-120-114.rdu2.redhat.com [10.10.120.114]) by smtp.corp.redhat.com (Postfix) with ESMTP id 35C153AE; Wed, 18 Mar 2020 22:15:04 +0000 (UTC) From: Waiman Long To: David Howells , Jarkko Sakkinen , James Morris , "Serge E. Hallyn" , Mimi Zohar , "David S. Miller" , Jakub Kicinski Cc: keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, netdev@vger.kernel.org, linux-afs@lists.infradead.org, Sumit Garg , Jerry Snitselaar , Roberto Sassu , Eric Biggers , Chris von Recklinghausen , Waiman Long Subject: [PATCH v5 0/2] KEYS: Read keys to internal buffer & then copy to userspace Date: Wed, 18 Mar 2020 18:14:55 -0400 Message-Id: <20200318221457.1330-1-longman@redhat.com> X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org v5: - Merge v4 patches 2 and 3 into 1 to avoid sparse warning. Merge some of commit logs into patch 1 as well. There is no further change. v4: - Remove the __user annotation from big_key_read() and user_read() in patch 1. - Add a new patch 2 to remove __user annotation from rxrpc_read(). - Add a new patch 3 to remove __user annotation from dns_resolver_read(). - Merge the original patches 2 and 3 into a single patch 4 and refactor it as suggested by Jarkko and Eric. v3: - Reorganize the keyctl_read_key() code to make it more readable as suggested by Jarkko Sakkinen. - Add patch 3 to use kvmalloc() for safer large buffer allocation as suggested by David Howells. v2: - Handle NULL buffer and buflen properly in patch 1. - Fix a bug in big_key.c. - Add patch 2 to handle arbitrary large user-supplied buflen. The current security key read methods are called with the key semaphore held. The methods then copy out the key data to userspace which is subjected to page fault and may acquire the mmap semaphore. That can result in circular lock dependency and hence a chance to get into deadlock. To avoid such a deadlock, an internal buffer is now allocated for getting out the necessary data first. After releasing the key semaphore, the key data are then copied out to userspace sidestepping the circular lock dependency. The keyutils test suite was run and the test passed with these patchset applied without any falure. Waiman Long (2): KEYS: Don't write out to userspace while holding key semaphore KEYS: Avoid false positive ENOMEM error on key read include/keys/big_key-type.h | 2 +- include/keys/user-type.h | 3 +- include/linux/key-type.h | 2 +- net/dns_resolver/dns_key.c | 2 +- net/rxrpc/key.c | 27 +++---- security/keys/big_key.c | 11 ++- security/keys/encrypted-keys/encrypted.c | 7 +- security/keys/internal.h | 12 ++++ security/keys/keyctl.c | 86 ++++++++++++++++++++--- security/keys/keyring.c | 6 +- security/keys/request_key_auth.c | 7 +- security/keys/trusted-keys/trusted_tpm1.c | 14 +--- security/keys/user_defined.c | 5 +- 13 files changed, 116 insertions(+), 68 deletions(-) -- 2.18.1