Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > linux.kernel > #1316556

[PATCH 3.12 24/39] KEYS: Fix race between read and revoke

From Jiri Slaby <jslaby@suse.cz>
Newsgroups linux.kernel
Subject [PATCH 3.12 24/39] KEYS: Fix race between read and revoke
Date 2016-01-25 13:00 +0100
Message-ID <qUNYm-3kJ-13@gated-at.bofh.it> (permalink)
References <qUNYl-3kJ-3@gated-at.bofh.it>
Organization linux.* mail to news gateway

Show all headers | View raw

From: David Howells <dhowells@redhat.com>

3.12-stable review patch.  If anyone has any objections, please let me know.

===============

commit b4a1b4f5047e4f54e194681125c74c0aa64d637d upstream.

This fixes CVE-2015-7550.

There's a race between keyctl_read() and keyctl_revoke().  If the revoke
happens between keyctl_read() checking the validity of a key and the key's
semaphore being taken, then the key type read method will see a revoked key.

This causes a problem for the user-defined key type because it assumes in
its read method that there will always be a payload in a non-revoked key
and doesn't check for a NULL pointer.

Fix this by making keyctl_read() check the validity of a key after taking
semaphore instead of before.

I think the bug was introduced with the original keyrings code.

This was discovered by a multithreaded test program generated by syzkaller
(http://github.com/google/syzkaller).  Here's a cleaned up version:

	#include <sys/types.h>
	#include <keyutils.h>
	#include <pthread.h>
	void *thr0(void *arg)
	{
		key_serial_t key = (unsigned long)arg;
		keyctl_revoke(key);
		return 0;
	}
	void *thr1(void *arg)
	{
		key_serial_t key = (unsigned long)arg;
		char buffer[16];
		keyctl_read(key, buffer, 16);
		return 0;
	}
	int main()
	{
		key_serial_t key = add_key("user", "%", "foo", 3, KEY_SPEC_USER_KEYRING);
		pthread_t th[5];
		pthread_create(&th[0], 0, thr0, (void *)(unsigned long)key);
		pthread_create(&th[1], 0, thr1, (void *)(unsigned long)key);
		pthread_create(&th[2], 0, thr0, (void *)(unsigned long)key);
		pthread_create(&th[3], 0, thr1, (void *)(unsigned long)key);
		pthread_join(th[0], 0);
		pthread_join(th[1], 0);
		pthread_join(th[2], 0);
		pthread_join(th[3], 0);
		return 0;
	}

Build as:

	cc -o keyctl-race keyctl-race.c -lkeyutils -lpthread

Run as:

	while keyctl-race; do :; done

as it may need several iterations to crash the kernel.  The crash can be
summarised as:

	BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
	IP: [<ffffffff81279b08>] user_read+0x56/0xa3
	...
	Call Trace:
	 [<ffffffff81276aa9>] keyctl_read_key+0xb6/0xd7
	 [<ffffffff81277815>] SyS_keyctl+0x83/0xe0
	 [<ffffffff815dbb97>] entry_SYSCALL_64_fastpath+0x12/0x6f

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
 security/keys/keyctl.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index 33cfd27b4de2..3242195bfa95 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -744,16 +744,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)
 
 	/* the key is probably readable - now try to read it */
 can_read_key:
-	ret = key_validate(key);
-	if (ret == 0) {
-		ret = -EOPNOTSUPP;
-		if (key->type->read) {
-			/* read the data with the semaphore held (since we
-			 * might sleep) */
-			down_read(&key->sem);
+	ret = -EOPNOTSUPP;
+	if (key->type->read) {
+		/* Read the data with the semaphore held (since we might sleep)
+		 * to protect against the key being updated or revoked.
+		 */
+		down_read(&key->sem);
+		ret = key_validate(key);
+		if (ret == 0)
 			ret = key->type->read(key, buffer, buflen);
-			up_read(&key->sem);
-		}
+		up_read(&key->sem);
 	}
 
 error2:
-- 
2.7.0

Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread

Thread

[PATCH 3.12 01/39] efi: Disable interrupts around EFI calls, not in the epilog/prolog calls Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 02/39] tools: Add a "make all" rule Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 26/39] udp: properly support MSG_PEEK with truncated buffers Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 24/39] KEYS: Fix race between read and revoke Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 22/39] sctp: Prevent soft lockup when sctp_accept() is called during a timeout event Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 28/39] xen/gntdev: Grant maps should not be subject to NUMA balancing Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 36/39] MAINTAINERS: Add public mailing list for ARC Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 27/39] x86/signal: Fix restart_syscall number for x32 tasks Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 16/39] staging/dgnc: fix info leak in ioctl Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 37/39] ARC: Fix silly typo in MAINTAINERS file commit 30b9dbee895ff0d5cbf155bd1ef3f0f5992bca6f upstream. Signed-off-by: Jiri Slaby <jslaby@suse.cz> Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 25/39] KEYS: Fix keyring ref leak in join_session_keyring() Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 32/39] x86/boot: Double BOOT_HEAP_SIZE to 64KB Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 38/39] isdn_ppp: Add checks for allocation failure in isdn_ppp_open() Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 12/39] block: Always check queue limits for cloned requests Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 20/39] m68k/mm: Check for mm != NULL in do_page_fault() debug code Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 18/39] m32r: fix potential NULL-pointer dereference Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 15/39] module: remove MODULE_GENERIC_TABLE Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 23/39] USB: quirks: Fix another ELAN touchscreen Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 17/39] pm: use GFP_ATOMIC when pm core call this function Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 39/39] ppp, slip: Validate VJ compression slot parameters completely Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 30/39] KVM: PPC: Book3S HV: Prohibit setting illegal transaction state in MSR Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 21/39] m68k/mac: Make SCC reset work more reliably Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 34/39] ALSA: hda - Add Intel Lewisburg device IDs Audio Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 04/39] dlm: make posix locks interruptible Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 35/39] ALSA: hda - Apply pin fixup for HP ProBook 6550b Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 14/39] qla2xxx: Fix hardware lock/unlock issue causing kernel panic. Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 29/39] x86/xen: don't reset vcpu_info on a cancelled suspend Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:00 +0100
  [PATCH 3.12 10/39] drm/i915: Fix SRC_COPY width on 830/845g Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 07/39] route: Use ipv4_mtu instead of raw rt_pmtu Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 13/39] Input: aiptek - fix crash on detecting device without endpoints Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 05/39] PCI: Drop "setting latency timer" messages Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 11/39] lpfc: Fix null ndlp dereference in target_reset_handler Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 09/39] ring-buffer: Always run per-cpu ring buffer resize with schedule_work_on() Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 06/39] ipv4: Don't increase PMTU with Datagram Too Big message. Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 03/39] ALSA: hda - Fix noise problems on Thinkpad T440s Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100
  [PATCH 3.12 08/39] SUNRPC: Fix oops when trace sunrpc_task events in nfs client Jiri Slaby <jslaby@suse.cz> - 2016-01-25 13:10 +0100

csiph-web