Messages in this thread Patch in this message | | | Date | Tue, 07 Feb 2006 22:45:16 -0800 | From | Chris Wright <> | Subject | [PATCH 13/23] Fix keyctl usage of strnlen_user() |
| |
-stable review patch. If anyone has any objections, please let us know. ------------------
In the small window between strnlen_user() and copy_from_user() userspace could alter the terminating `\0' character.
Signed-off-by: Davi Arnaut <davi.arnaut@gmail.com> Cc: David Howells <dhowells@redhat.com> Cc: <stable@kernel.org> Signed-off-by: Andrew Morton <akpm@osdl.org> Signed-off-by: Chris Wright <chrisw@sous-sol.org> ---
security/keys/keyctl.c | 15 ++++++++++----- 1 files changed, 10 insertions(+), 5 deletions(-)
Index: linux-2.6.15.3/security/keys/keyctl.c =================================================================== --- linux-2.6.15.3.orig/security/keys/keyctl.c +++ linux-2.6.15.3/security/keys/keyctl.c @@ -66,9 +66,10 @@ asmlinkage long sys_add_key(const char _ description = kmalloc(dlen + 1, GFP_KERNEL); if (!description) goto error; + description[dlen] = '\0'; ret = -EFAULT; - if (copy_from_user(description, _description, dlen + 1) != 0) + if (copy_from_user(description, _description, dlen) != 0) goto error2; /* pull the payload in if one was supplied */ @@ -160,9 +161,10 @@ asmlinkage long sys_request_key(const ch description = kmalloc(dlen + 1, GFP_KERNEL); if (!description) goto error; + description[dlen] = '\0'; ret = -EFAULT; - if (copy_from_user(description, _description, dlen + 1) != 0) + if (copy_from_user(description, _description, dlen) != 0) goto error2; /* pull the callout info into kernel space */ @@ -181,9 +183,10 @@ asmlinkage long sys_request_key(const ch callout_info = kmalloc(dlen + 1, GFP_KERNEL); if (!callout_info) goto error2; + callout_info[dlen] = '\0'; ret = -EFAULT; - if (copy_from_user(callout_info, _callout_info, dlen + 1) != 0) + if (copy_from_user(callout_info, _callout_info, dlen) != 0) goto error3; } @@ -278,9 +281,10 @@ long keyctl_join_session_keyring(const c name = kmalloc(nlen + 1, GFP_KERNEL); if (!name) goto error; + name[nlen] = '\0'; ret = -EFAULT; - if (copy_from_user(name, _name, nlen + 1) != 0) + if (copy_from_user(name, _name, nlen) != 0) goto error2; } @@ -582,9 +586,10 @@ long keyctl_keyring_search(key_serial_t description = kmalloc(dlen + 1, GFP_KERNEL); if (!description) goto error; + description[dlen] = '\0'; ret = -EFAULT; - if (copy_from_user(description, _description, dlen + 1) != 0) + if (copy_from_user(description, _description, dlen) != 0) goto error2; /* get the keyring at which to begin the search */ -- - To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |