lkml.org 
[lkml]   [2006]   [Feb]   [8]   [last100]   RSS Feed
Views: [more markup]  [less markup]  [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    DateTue, 07 Feb 2006 22:45:16 -0800
    FromChris Wright <>
    Subject[PATCH 13/23] Fix keyctl usage of strnlen_user()
    -stable review patch.  If anyone has any objections, please let us know.
    ------------------
    In the small window between strnlen_user() and copy_from_user() userspace
    could alter the terminating `\0' character.
    
    Signed-off-by: Davi Arnaut <davi.arnaut@gmail.com>
    Cc: David Howells <dhowells@redhat.com>
    Cc: <stable@kernel.org>
    Signed-off-by: Andrew Morton <akpm@osdl.org>
    Signed-off-by: Chris Wright <chrisw@sous-sol.org>
    ---
     security/keys/keyctl.c |   15 ++++++++++-----
     1 files changed, 10 insertions(+), 5 deletions(-)
    Index: linux-2.6.15.3/security/keys/keyctl.c
    ===================================================================
    --- linux-2.6.15.3.orig/security/keys/keyctl.c
    +++ linux-2.6.15.3/security/keys/keyctl.c
    @@ -66,9 +66,10 @@ asmlinkage long sys_add_key(const char _
     	description = kmalloc(dlen + 1, GFP_KERNEL);
     	if (!description)
     		goto error;
    +	description[dlen] = '\0';
     
     	ret = -EFAULT;
    -	if (copy_from_user(description, _description, dlen + 1) != 0)
    +	if (copy_from_user(description, _description, dlen) != 0)
     		goto error2;
     
     	/* pull the payload in if one was supplied */
    @@ -160,9 +161,10 @@ asmlinkage long sys_request_key(const ch
     	description = kmalloc(dlen + 1, GFP_KERNEL);
     	if (!description)
     		goto error;
    +	description[dlen] = '\0';
     
     	ret = -EFAULT;
    -	if (copy_from_user(description, _description, dlen + 1) != 0)
    +	if (copy_from_user(description, _description, dlen) != 0)
     		goto error2;
     
     	/* pull the callout info into kernel space */
    @@ -181,9 +183,10 @@ asmlinkage long sys_request_key(const ch
     		callout_info = kmalloc(dlen + 1, GFP_KERNEL);
     		if (!callout_info)
     			goto error2;
    +		callout_info[dlen] = '\0';
     
     		ret = -EFAULT;
    -		if (copy_from_user(callout_info, _callout_info, dlen + 1) != 0)
    +		if (copy_from_user(callout_info, _callout_info, dlen) != 0)
     			goto error3;
     	}
     
    @@ -278,9 +281,10 @@ long keyctl_join_session_keyring(const c
     		name = kmalloc(nlen + 1, GFP_KERNEL);
     		if (!name)
     			goto error;
    +		name[nlen] = '\0';
     
     		ret = -EFAULT;
    -		if (copy_from_user(name, _name, nlen + 1) != 0)
    +		if (copy_from_user(name, _name, nlen) != 0)
     			goto error2;
     	}
     
    @@ -582,9 +586,10 @@ long keyctl_keyring_search(key_serial_t 
     	description = kmalloc(dlen + 1, GFP_KERNEL);
     	if (!description)
     		goto error;
    +	description[dlen] = '\0';
     
     	ret = -EFAULT;
    -	if (copy_from_user(description, _description, dlen + 1) != 0)
    +	if (copy_from_user(description, _description, dlen) != 0)
     		goto error2;
     
     	/* get the keyring at which to begin the search */
    --
    -
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at  http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at  http://www.tux.org/lkml/
    
    
    \
     
     \ /
      Last update: 2006-02-08 07:53    [from the cache]
    ©2003-2008