lkml.org 
[lkml]   [2017]   [Nov]   [28]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.9 032/138] libceph: dont WARN() if user tries to add invalid key
    Date
    4.9-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Eric Biggers <ebiggers@google.com>

    commit b11270853fa3654f08d4a6a03b23ddb220512d8d upstream.

    The WARN_ON(!key->len) in set_secret() in net/ceph/crypto.c is hit if a
    user tries to add a key of type "ceph" with an invalid payload as
    follows (assuming CONFIG_CEPH_LIB=y):

    echo -e -n '\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00' \
    | keyctl padd ceph desc @s

    This can be hit by fuzzers. As this is merely bad input and not a
    kernel bug, replace the WARN_ON() with return -EINVAL.

    Fixes: 7af3ea189a9a ("libceph: stop allocating a new cipher on every crypto request")
    Signed-off-by: Eric Biggers <ebiggers@google.com>
    Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

    ---
    net/ceph/crypto.c | 4 +++-
    1 file changed, 3 insertions(+), 1 deletion(-)

    --- a/net/ceph/crypto.c
    +++ b/net/ceph/crypto.c
    @@ -34,7 +34,9 @@ static int set_secret(struct ceph_crypto
    return -ENOTSUPP;
    }

    - WARN_ON(!key->len);
    + if (!key->len)
    + return -EINVAL;
    +
    key->key = kmemdup(buf, key->len, GFP_NOIO);
    if (!key->key) {
    ret = -ENOMEM;

    \
     
     \ /
      Last update: 2017-11-28 13:03    [W:3.117 / U:0.208 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site