From: Waiman Long <longman@redhat.com> To: David Howells <dhowells@redhat.com>, Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>, James Morris <jmorris@namei.org>, "Serge E. Hallyn" <serge@hallyn.com>, Mimi Zohar <zohar@linux.ibm.com> Cc: keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, Sumit Garg <sumit.garg@linaro.org>, Jerry Snitselaar <jsnitsel@redhat.com>, Roberto Sassu <roberto.sassu@huawei.com>, Eric Biggers <ebiggers@google.com>, Chris von Recklinghausen <crecklin@redhat.com>, Waiman Long <longman@redhat.com> Subject: [PATCH v2 2/2] KEYS: Avoid false positive ENOMEM error on key read Date: Sun, 08 Mar 2020 17:04:10 +0000 [thread overview] Message-ID: <20200308170410.14166-3-longman@redhat.com> (raw) In-Reply-To: <20200308170410.14166-1-longman@redhat.com> By allocating a kernel buffer with an user-supplied buffer length, it is possible that a false positive ENOMEM error may be returned because the user-supplied length is just too large even if the system do have enough memory to hold the actual key data. To reduce this possibility, we set a threshold (1024) over which we do check the actual key length first before allocating a buffer of the right size to hold it. Signed-off-by: Waiman Long <longman@redhat.com> --- security/keys/keyctl.c | 46 ++++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c index 89a14e71eb0a..662a638a680d 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c @@ -855,28 +855,52 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) * deadlock involving page fault and mmap_sem. */ char *tmpbuf = NULL; + size_t tbuflen = buflen; - if (buffer && buflen) { - tmpbuf = kmalloc(buflen, GFP_KERNEL); + /* + * We don't want an erronous -ENOMEM error due to an + * arbitrary large user-supplied buflen. So if buflen + * exceeds a threshold (1024 bytes in this case), we call + * the read method twice. The first time to get the buffer + * length and the second time to read out the key data. + * + * N.B. All the read methods will return the required + * buffer length with a NULL input buffer or when + * the input buffer length isn't large enough. + */ + if (buflen && buffer && (buflen <= 0x400)) { +allocbuf: + tmpbuf = kmalloc(tbuflen, GFP_KERNEL); if (!tmpbuf) { ret = -ENOMEM; goto error2; } } + down_read(&key->sem); ret = key_validate(key); if (ret = 0) - ret = key->type->read(key, tmpbuf, buflen); + ret = key->type->read(key, tmpbuf, tbuflen); up_read(&key->sem); - /* - * Read methods will just return the required length - * without any copying if the provided length isn't big - * enough. - */ - if ((ret > 0) && (ret <= buflen) && buffer && - copy_to_user(buffer, tmpbuf, ret)) - ret = -EFAULT; + if ((ret > 0) && (ret <= buflen) && buffer) { + /* + * It is possible, though unlikely, that the key + * changes in between the up_read->down_read period. + * If the key becomes longer, we will have to + * allocate a larger buffer and redo the key read + * again. + */ + if (!tmpbuf || unlikely(ret > tbuflen)) { + tbuflen = ret; + if (unlikely(tmpbuf)) + kzfree(tmpbuf); + goto allocbuf; + } + + if (copy_to_user(buffer, tmpbuf, ret)) + ret = -EFAULT; + } if (tmpbuf) kzfree(tmpbuf); -- 2.18.1
WARNING: multiple messages have this Message-ID (diff)
From: Waiman Long <longman@redhat.com> To: David Howells <dhowells@redhat.com>, Jarkko Sakkinen <jarkko.sakkinen@linux.intel.com>, James Morris <jmorris@namei.org>, "Serge E. Hallyn" <serge@hallyn.com>, Mimi Zohar <zohar@linux.ibm.com> Cc: keyrings@vger.kernel.org, linux-kernel@vger.kernel.org, linux-security-module@vger.kernel.org, linux-integrity@vger.kernel.org, Sumit Garg <sumit.garg@linaro.org>, Jerry Snitselaar <jsnitsel@redhat.com>, Roberto Sassu <roberto.sassu@huawei.com>, Eric Biggers <ebiggers@google.com>, Chris von Recklinghausen <crecklin@redhat.com>, Waiman Long <longman@redhat.com> Subject: [PATCH v2 2/2] KEYS: Avoid false positive ENOMEM error on key read Date: Sun, 8 Mar 2020 13:04:10 -0400 [thread overview] Message-ID: <20200308170410.14166-3-longman@redhat.com> (raw) In-Reply-To: <20200308170410.14166-1-longman@redhat.com> By allocating a kernel buffer with an user-supplied buffer length, it is possible that a false positive ENOMEM error may be returned because the user-supplied length is just too large even if the system do have enough memory to hold the actual key data. To reduce this possibility, we set a threshold (1024) over which we do check the actual key length first before allocating a buffer of the right size to hold it. Signed-off-by: Waiman Long <longman@redhat.com> --- security/keys/keyctl.c | 46 ++++++++++++++++++++++++++++++++---------- 1 file changed, 35 insertions(+), 11 deletions(-) diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c index 89a14e71eb0a..662a638a680d 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c @@ -855,28 +855,52 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) * deadlock involving page fault and mmap_sem. */ char *tmpbuf = NULL; + size_t tbuflen = buflen; - if (buffer && buflen) { - tmpbuf = kmalloc(buflen, GFP_KERNEL); + /* + * We don't want an erronous -ENOMEM error due to an + * arbitrary large user-supplied buflen. So if buflen + * exceeds a threshold (1024 bytes in this case), we call + * the read method twice. The first time to get the buffer + * length and the second time to read out the key data. + * + * N.B. All the read methods will return the required + * buffer length with a NULL input buffer or when + * the input buffer length isn't large enough. + */ + if (buflen && buffer && (buflen <= 0x400)) { +allocbuf: + tmpbuf = kmalloc(tbuflen, GFP_KERNEL); if (!tmpbuf) { ret = -ENOMEM; goto error2; } } + down_read(&key->sem); ret = key_validate(key); if (ret == 0) - ret = key->type->read(key, tmpbuf, buflen); + ret = key->type->read(key, tmpbuf, tbuflen); up_read(&key->sem); - /* - * Read methods will just return the required length - * without any copying if the provided length isn't big - * enough. - */ - if ((ret > 0) && (ret <= buflen) && buffer && - copy_to_user(buffer, tmpbuf, ret)) - ret = -EFAULT; + if ((ret > 0) && (ret <= buflen) && buffer) { + /* + * It is possible, though unlikely, that the key + * changes in between the up_read->down_read period. + * If the key becomes longer, we will have to + * allocate a larger buffer and redo the key read + * again. + */ + if (!tmpbuf || unlikely(ret > tbuflen)) { + tbuflen = ret; + if (unlikely(tmpbuf)) + kzfree(tmpbuf); + goto allocbuf; + } + + if (copy_to_user(buffer, tmpbuf, ret)) + ret = -EFAULT; + } if (tmpbuf) kzfree(tmpbuf); -- 2.18.1
next prev parent reply other threads:[~2020-03-08 17:04 UTC|newest] Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top 2020-03-08 17:04 [PATCH v2 0/2] KEYS: Read keys to internal buffer & then copy to userspace Waiman Long 2020-03-08 17:04 ` Waiman Long 2020-03-08 17:04 ` [PATCH v2 1/2] KEYS: Don't write out to userspace while holding key semaphore Waiman Long 2020-03-08 17:04 ` Waiman Long 2020-03-13 1:04 ` Jarkko Sakkinen 2020-03-13 1:04 ` Jarkko Sakkinen 2020-03-13 13:29 ` Waiman Long 2020-03-13 13:29 ` Waiman Long 2020-03-13 15:28 ` Jarkko Sakkinen 2020-03-13 15:28 ` Jarkko Sakkinen 2020-03-13 16:57 ` Waiman Long 2020-03-13 16:57 ` Waiman Long 2020-03-08 17:04 ` Waiman Long [this message] 2020-03-08 17:04 ` [PATCH v2 2/2] KEYS: Avoid false positive ENOMEM error on key read Waiman Long 2020-03-09 16:32 ` David Howells 2020-03-10 15:45 ` Waiman Long 2020-03-10 15:45 ` Waiman Long 2020-03-10 15:58 ` Waiman Long 2020-03-10 15:58 ` Waiman Long 2020-03-10 17:12 ` David Howells 2020-03-11 15:33 ` Waiman Long 2020-03-11 15:33 ` Waiman Long 2020-03-11 15:33 ` Waiman Long
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20200308170410.14166-3-longman@redhat.com \ --to=longman@redhat.com \ --cc=crecklin@redhat.com \ --cc=dhowells@redhat.com \ --cc=ebiggers@google.com \ --cc=jarkko.sakkinen@linux.intel.com \ --cc=jmorris@namei.org \ --cc=jsnitsel@redhat.com \ --cc=keyrings@vger.kernel.org \ --cc=linux-integrity@vger.kernel.org \ --cc=linux-kernel@vger.kernel.org \ --cc=linux-security-module@vger.kernel.org \ --cc=roberto.sassu@huawei.com \ --cc=serge@hallyn.com \ --cc=sumit.garg@linaro.org \ --cc=zohar@linux.ibm.com \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: linkBe sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.