• Eric Biggers's avatar
    ecryptfs: fix dereference of NULL user_key_payload · f66665c0
    Eric Biggers authored
    In eCryptfs, we failed to verify that the authentication token keys are
    not revoked before dereferencing their payloads, which is problematic
    because the payload of a revoked key is NULL.  request_key() *does* skip
    revoked keys, but there is still a window where the key can be revoked
    before we acquire the key semaphore.
    
    Fix it by updating ecryptfs_get_key_payload_data() to return
    -EKEYREVOKED if the key payload is NULL.  For completeness we check this
    for "encrypted" keys as well as "user" keys, although encrypted keys
    cannot be revoked currently.
    
    Alternatively we could use key_validate(), but since we'll also need to
    fix ecryptfs_get_key_payload_data() to validate the payload length, it
    seems appropriate to just check the payload pointer.
    
    Fixes: 237fead6
    
     ("[PATCH] ecryptfs: fs/Makefile and fs/Kconfig")
    Reviewed-by: default avatarJames Morris <james.l.morris@oracle.com>
    Cc: <stable@vger.kernel.org>    [v2.6.19+]
    Cc: Michael Halcrow <mhalcrow@google.com>
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    f66665c0
ecryptfs_kernel.h 25.1 KB