From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1423342AbdD1R5T (ORCPT ); Fri, 28 Apr 2017 13:57:19 -0400 Received: from mail-pf0-f196.google.com ([209.85.192.196]:35858 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1422976AbdD1R5Q (ORCPT ); Fri, 28 Apr 2017 13:57:16 -0400 Date: Fri, 28 Apr 2017 10:57:12 -0700 From: Eric Biggers To: keyrings@vger.kernel.org Cc: linux-security-module@vger.kernel.org, David Howells , linux-kernel@vger.kernel.org, Eric Biggers Subject: Re: [PATCH 1/5] KEYS: sanitize add_key() and keyctl() key payloads Message-ID: <20170428175712.GA14932@gmail.com> References: <20170421083037.12746-1-ebiggers3@gmail.com> <20170421083037.12746-2-ebiggers3@gmail.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20170421083037.12746-2-ebiggers3@gmail.com> User-Agent: Mutt/1.5.21 (2010-09-15) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hey David, On Fri, Apr 21, 2017 at 01:30:33AM -0700, Eric Biggers wrote: > From: Eric Biggers > > Before returning from add_key() or one of the keyctl() commands that > takes in a key payload, zero the temporary buffer that was allocated to > hold the key payload copied from userspace. This may contain sensitive > key material that should not be kept around in the slab caches. > > This must not be applied before the patch "KEYS: fix dereferencing NULL > payload with nonzero length". > > Signed-off-by: Eric Biggers Can you make sure that my other patch "KEYS: fix dereferencing NULL payload with nonzero length" gets applied along with this one? Otherwise triggering the NULL pointer dereference (which really needs to be fixed anyway) becomes even more trivial. The only reason I didn't check for NULL before doing the memsets is that the bug was going to have to be fixed anyway, and the fix backported. - Eric