Linux-Security-Module Archive on lore.kernel.org
 help / Atom feed
* [PATCH] security: keys: add NULL checking for key->type->instantiate
@ 2019-01-25  7:16 Geliang Tang
  2019-02-06 22:26 ` David Howells
  0 siblings, 1 reply; 4+ messages in thread
From: Geliang Tang @ 2019-01-25  7:16 UTC (permalink / raw)
  To: David Howells, James Morris, Serge E. Hallyn
  Cc: Geliang Tang, keyrings, linux-security-module, linux-kernel

key->type->instantiate can be NULL, add NULL checking to prevent
NULL pointer dereference in __key_instantiate_and_link().

Signed-off-by: Geliang Tang <geliangtang@gmail.com>
---
 security/keys/key.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/security/keys/key.c b/security/keys/key.c
index 44a80d6741a1..ae3cc11be0d2 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -438,7 +438,8 @@ static int __key_instantiate_and_link(struct key *key,
 	/* can't instantiate twice */
 	if (key->state == KEY_IS_UNINSTANTIATED) {
 		/* instantiate the key */
-		ret = key->type->instantiate(key, prep);
+		if (key->type->instantiate)
+			ret = key->type->instantiate(key, prep);
 
 		if (ret == 0) {
 			/* mark the key as being instantiated */
-- 
2.17.1


^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] security: keys: add NULL checking for key->type->instantiate
  2019-01-25  7:16 [PATCH] security: keys: add NULL checking for key->type->instantiate Geliang Tang
@ 2019-02-06 22:26 ` David Howells
  2019-02-26  9:09   ` Geliang Tang
  2019-02-26  9:11   ` Geliang Tang
  0 siblings, 2 replies; 4+ messages in thread
From: David Howells @ 2019-02-06 22:26 UTC (permalink / raw)
  To: Geliang Tang
  Cc: dhowells, James Morris, Serge E. Hallyn, keyrings,
	linux-security-module, linux-kernel

Geliang Tang <geliangtang@gmail.com> wrote:

> key->type->instantiate can be NULL, add NULL checking to prevent
> NULL pointer dereference in __key_instantiate_and_link().

Do you have an oops report or test case for this?

David

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] security: keys: add NULL checking for key->type->instantiate
  2019-02-06 22:26 ` David Howells
@ 2019-02-26  9:09   ` Geliang Tang
  2019-02-26  9:11   ` Geliang Tang
  1 sibling, 0 replies; 4+ messages in thread
From: Geliang Tang @ 2019-02-26  9:09 UTC (permalink / raw)
  To: David Howells, James Morris, Serge E. Hallyn
  Cc: keyrings, linux-security-module, linux-kernel

On Wed, Feb 06, 2019 at 10:26:53PM +0000, David Howells wrote:
> Geliang Tang <geliangtang@gmail.com> wrote:
> 
> > key->type->instantiate can be NULL, add NULL checking to prevent
> > NULL pointer dereference in __key_instantiate_and_link().
> 
> Do you have an oops report or test case for this?
> 
> David

Here is the test module code. Insmod it, we can get the oops.

#include <linux/init.h>
#include <linux/module.h>
#include <linux/key.h>
#include <linux/key-type.h>
#include <linux/cred.h>
#include <linux/seq_file.h>

static int test_instantiate(struct key *key, struct key_preparsed_payload *prep)
{
	return 0;
}

static void test_describe(const struct key *key, struct seq_file *m)
{
	seq_puts(m, key->description);
}

struct key_type test_key_type = {
        .name           = "test",
	//.instantiate	= test_instantiate,
        .describe       = test_describe,
};

static int __init test_init(void)
{
	const struct cred *cred = current_cred();
	struct key *key;
	int ret;

	register_key_type(&test_key_type);

	key = key_alloc(&test_key_type, "test",
			GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
			KEY_POS_SEARCH, KEY_ALLOC_NOT_IN_QUOTA, NULL);
	if (IS_ERR(key))
		return -1;

	pr_info("keyring allocated successfully.\n");

	ret = key_instantiate_and_link(key,
				       NULL,
				       sizeof(int),
				       current->cred->user->session_keyring,
				       NULL);
	if (ret < 0) {
		key_revoke(key);
		key_put(key);
		return ret;
	}

	return 0;
}

static void __exit test_exit(void)
{
	unregister_key_type(&test_key_type);
}

module_init(test_init);
module_exit(test_exit);

MODULE_LICENSE("GPL");

^ permalink raw reply	[flat|nested] 4+ messages in thread

* Re: [PATCH] security: keys: add NULL checking for key->type->instantiate
  2019-02-06 22:26 ` David Howells
  2019-02-26  9:09   ` Geliang Tang
@ 2019-02-26  9:11   ` Geliang Tang
  1 sibling, 0 replies; 4+ messages in thread
From: Geliang Tang @ 2019-02-26  9:11 UTC (permalink / raw)
  To: David Howells, James Morris, Serge E. Hallyn
  Cc: keyrings, linux-security-module, linux-kernel

On Wed, Feb 06, 2019 at 10:26:53PM +0000, David Howells wrote:
> Geliang Tang <geliangtang@gmail.com> wrote:
> 
> > key->type->instantiate can be NULL, add NULL checking to prevent
> > NULL pointer dereference in __key_instantiate_and_link().
> 
> Do you have an oops report or test case for this?
> 
> David

Here is the test module code. Insmod it, we can get the oops.

#include <linux/init.h>
#include <linux/module.h>
#include <linux/key.h>
#include <linux/key-type.h>
#include <linux/cred.h>
#include <linux/seq_file.h>

static int test_instantiate(struct key *key, struct key_preparsed_payload *prep)
{
	return 0;
}

static void test_describe(const struct key *key, struct seq_file *m)
{
	seq_puts(m, key->description);
}

struct key_type test_key_type = {
        .name           = "test",
	//.instantiate	= test_instantiate,
        .describe       = test_describe,
};

static int __init test_init(void)
{
	const struct cred *cred = current_cred();
	struct key *key;
	int ret;

	register_key_type(&test_key_type);

	key = key_alloc(&test_key_type, "test",
			GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, cred,
			KEY_POS_SEARCH, KEY_ALLOC_NOT_IN_QUOTA, NULL);
	if (IS_ERR(key))
		return -1;

	pr_info("keyring allocated successfully.\n");

	ret = key_instantiate_and_link(key,
				       NULL,
				       sizeof(int),
				       current->cred->user->session_keyring,
				       NULL);
	if (ret < 0) {
		key_revoke(key);
		key_put(key);
		return ret;
	}

	return 0;
}

static void __exit test_exit(void)
{
	unregister_key_type(&test_key_type);
}

module_init(test_init);
module_exit(test_exit);

MODULE_LICENSE("GPL");

^ permalink raw reply	[flat|nested] 4+ messages in thread

end of thread, back to index

Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-01-25  7:16 [PATCH] security: keys: add NULL checking for key->type->instantiate Geliang Tang
2019-02-06 22:26 ` David Howells
2019-02-26  9:09   ` Geliang Tang
2019-02-26  9:11   ` Geliang Tang

Linux-Security-Module Archive on lore.kernel.org

Archives are clonable:
	git clone --mirror https://lore.kernel.org/linux-security-module/0 linux-security-module/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 linux-security-module linux-security-module/ https://lore.kernel.org/linux-security-module \
		linux-security-module@vger.kernel.org linux-security-module@archiver.kernel.org
	public-inbox-index linux-security-module


Newsgroup available over NNTP:
	nntp://nntp.lore.kernel.org/org.kernel.vger.linux-security-module


AGPL code for this site: git clone https://public-inbox.org/ public-inbox