Merge tag 'keys-fixes-20171208' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs into keys-for-linus

Assorted fixes for keyrings, ASN.1, X.509 and PKCS#7.

James Morris committed 8 years ago

Commit 4ded3be2 parents f335195 54c1fb311 files · +101 −69Browse files

Unified · Split

11 files

crypto/asymmetric_keys/pkcs7_parser.c +3 −1
crypto/asymmetric_keys/pkcs7_trust.c +1 −1
crypto/asymmetric_keys/pkcs7_verify.c +3 −6
crypto/asymmetric_keys/public_key.c +5 −2
crypto/asymmetric_keys/x509_cert_parser.c +2 −0
crypto/asymmetric_keys/x509_public_key.c +2 −6
lib/asn1_decoder.c +28 −21
lib/oid_registry.c +10 −6
security/keys/key.c +0 −1
security/keys/keyctl.c +10 −14
security/keys/request_key.c +37 −11

crypto/asymmetric_keys/pkcs7_parser.c+3−1

 	}
 	ret = pkcs7_check_authattrs(ctx->msg);
-	if (ret < 0)
+	if (ret < 0) {
+		msg = ERR_PTR(ret);
 		goto out;
+	}
 	msg = ctx->msg;
 	ctx->msg = NULL;

crypto/asymmetric_keys/pkcs7_trust.c+1−1

@@ -69,7 +69,7 @@ static int pkcs7_validate_trust_one(struct pkcs7_message *pkcs7, · 68 unmodified lines
69	/* Self-signed certificates form roots of their own, and if we	69	/* Self-signed certificates form roots of their own, and if we
70	* don't know them, then we can't accept them.	70	* don't know them, then we can't accept them.
71	*/	71	*/
72	if (x509->next == x509) {	72	if (x509->signer == x509) {
73	kleave(" = -ENOKEY [unknown self-signed]");	73	kleave(" = -ENOKEY [unknown self-signed]");
74	return -ENOKEY;	74	return -ENOKEY;
75	}	75	}

crypto/asymmetric_keys/pkcs7_verify.c+3−6

 	desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
 	/* Digest the message [RFC2315 9.3] */
-	ret = crypto_shash_init(desc);
+	ret = crypto_shash_digest(desc, pkcs7->data, pkcs7->data_len,
-	if (ret < 0)
+				  sig->digest);
-		goto error;
-	ret = crypto_shash_finup(desc, pkcs7->data, pkcs7->data_len,
-				 sig->digest);
 	if (ret < 0)
 		goto error;
 	pr_devel("MsgDigest = [%*ph]\n", 8, sig->digest);
 		pr_devel("Sig %u: Found cert serial match X.509[%u]\n",
 			 sinfo->index, certix);
-		if (x509->pub->pkey_algo != sinfo->sig->pkey_algo) {
+		if (strcmp(x509->pub->pkey_algo, sinfo->sig->pkey_algo) != 0) {
 			pr_warn("Sig %u: X.509 algo and PKCS#7 sig algo don't match\n",
 				sinfo->index);
 			continue;

crypto/asymmetric_keys/public_key.c+5−2

 	char alg_name_buf[CRYPTO_MAX_ALG_NAME];
 	void *output;
 	unsigned int outlen;
-	int ret = -ENOMEM;
+	int ret;
 	pr_devel("==>%s()\n", __func__);
 	if (IS_ERR(tfm))
 		return PTR_ERR(tfm);
+	ret = -ENOMEM;
 	req = akcipher_request_alloc(tfm, GFP_KERNEL);
 	if (!req)
 		goto error_free_tfm;
 	 * signature and returns that to us.
 	 */
 	ret = crypto_wait_req(crypto_akcipher_verify(req), &cwait);
-	if (ret < 0)
+	if (ret)
 		goto out_free_output;
 	/* Do the actual verification step. */
 error_free_tfm:
 	crypto_free_akcipher(tfm);
 	pr_devel("<==%s() = %d\n", __func__, ret);
+	if (WARN_ON_ONCE(ret > 0))
+		ret = -EINVAL;
 	return ret;
 }
 EXPORT_SYMBOL_GPL(public_key_verify_signature);

crypto/asymmetric_keys/x509_cert_parser.c+2−0

@@ -409,6 +409,8 @@ int x509_extract_key_data(void *context, size_t hdrlen, · 408 unmodified lines
409	ctx->cert->pub->pkey_algo = "rsa";	409	ctx->cert->pub->pkey_algo = "rsa";
410		410
411	/* Discard the BIT STRING metadata */	411	/* Discard the BIT STRING metadata */
		412	if (vlen < 1 \|\| (const u8 )value != 0)
		413	return -EBADMSG;
412	ctx->key = value + 1;	414	ctx->key = value + 1;
413	ctx->key_size = vlen - 1;	415	ctx->key_size = vlen - 1;
414	return 0;	416	return 0;

crypto/asymmetric_keys/x509_public_key.c+2−6

 	desc->tfm = tfm;
 	desc->flags = CRYPTO_TFM_REQ_MAY_SLEEP;
-	ret = crypto_shash_init(desc);
+	ret = crypto_shash_digest(desc, cert->tbs, cert->tbs_size, sig->digest);
-	if (ret < 0)
-		goto error_2;
-	might_sleep();
-	ret = crypto_shash_finup(desc, cert->tbs, cert->tbs_size, sig->digest);
 	if (ret < 0)
 		goto error_2;
 	}
 	ret = -EKEYREJECTED;
-	if (cert->pub->pkey_algo != cert->sig->pkey_algo)
+	if (strcmp(cert->pub->pkey_algo, cert->sig->pkey_algo) != 0)
 		goto out;
 	ret = public_key_verify_signature(cert->pub, cert->sig);

lib/asn1_decoder.c+28−21

 	/* Decide how to handle the operation */
 	switch (op) {
-	case ASN1_OP_MATCH_ANY_ACT:
-	case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
-	case ASN1_OP_COND_MATCH_ANY_ACT:
-	case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
-		ret = actions[machine[pc + 1]](context, hdr, tag, data + dp, len);
-		if (ret < 0)
-			return ret;
-		goto skip_data;
-	case ASN1_OP_MATCH_ACT:
-	case ASN1_OP_MATCH_ACT_OR_SKIP:
-	case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
-		ret = actions[machine[pc + 2]](context, hdr, tag, data + dp, len);
-		if (ret < 0)
-			return ret;
-		goto skip_data;
 	case ASN1_OP_MATCH:
 	case ASN1_OP_MATCH_OR_SKIP:
+	case ASN1_OP_MATCH_ACT:
+	case ASN1_OP_MATCH_ACT_OR_SKIP:
 	case ASN1_OP_MATCH_ANY:
 	case ASN1_OP_MATCH_ANY_OR_SKIP:
+	case ASN1_OP_MATCH_ANY_ACT:
+	case ASN1_OP_MATCH_ANY_ACT_OR_SKIP:
 	case ASN1_OP_COND_MATCH_OR_SKIP:
+	case ASN1_OP_COND_MATCH_ACT_OR_SKIP:
 	case ASN1_OP_COND_MATCH_ANY:
 	case ASN1_OP_COND_MATCH_ANY_OR_SKIP:
-	skip_data:
+	case ASN1_OP_COND_MATCH_ANY_ACT:
+	case ASN1_OP_COND_MATCH_ANY_ACT_OR_SKIP:
 		if (!(flags & FLAG_CONS)) {
 			if (flags & FLAG_INDEFINITE_LENGTH) {
+				size_t tmp = dp;
 				ret = asn1_find_indefinite_length(
-					data, datalen, &dp, &len, &errmsg);
+					data, datalen, &tmp, &len, &errmsg);
 				if (ret < 0)
 					goto error;
-			} else {
-				dp += len;
 			}
 			pr_debug("- LEAF: %zu\n", len);
 		}
+		if (op & ASN1_OP_MATCH__ACT) {
+			unsigned char act;
+			if (op & ASN1_OP_MATCH__ANY)
+				act = machine[pc + 1];
+			else
+				act = machine[pc + 2];
+			ret = actions[act](context, hdr, tag, data + dp, len);
+			if (ret < 0)
+				return ret;
+		}
+		if (!(flags & FLAG_CONS))
+			dp += len;
 		pc += asn1_op_lengths[op];
 		goto next_op;
 			else
 				act = machine[pc + 1];
 			ret = actions[act](context, hdr, 0, data + tdp, len);
+			if (ret < 0)
+				return ret;
 		}
 		pc += asn1_op_lengths[op];
 		goto next_op;

lib/oid_registry.c+10−6

 	int count;
 	if (v >= end)
-		return -EBADMSG;
+		goto bad;
 	n = *v++;
 	ret = count = snprintf(buffer, bufsize, "%u.%u", n / 40, n % 40);
+	if (count >= bufsize)
+		return -ENOBUFS;
 	buffer += count;
 	bufsize -= count;
-	if (bufsize == 0)
-		return -ENOBUFS;
 	while (v < end) {
 		num = 0;
 			num = n & 0x7f;
 			do {
 				if (v >= end)
-					return -EBADMSG;
+					goto bad;
 				n = *v++;
 				num <<= 7;
 				num |= n & 0x7f;
 			} while (n & 0x80);
 		}
 		ret += count = snprintf(buffer, bufsize, ".%lu", num);
-		buffer += count;
+		if (count >= bufsize)
-		if (bufsize <= count)
 			return -ENOBUFS;
+		buffer += count;
 		bufsize -= count;
 	}
 	return ret;
+bad:
+	snprintf(buffer, bufsize, "(bad)");
+	return -EBADMSG;
 }
 EXPORT_SYMBOL_GPL(sprint_oid);

security/keys/key.c+0−1

@@ -833,7 +833,6 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref, · 832 unmodified lines
833		833
834	key_check(keyring);	834	key_check(keyring);
835		835
836	key_ref = ERR_PTR(-EPERM);
837	if (!(flags & KEY_ALLOC_BYPASS_RESTRICTION))	836	if (!(flags & KEY_ALLOC_BYPASS_RESTRICTION))
838	restrict_link = keyring->restrict_link;	837	restrict_link = keyring->restrict_link;
839		838

security/keys/keyctl.c+10−14

  * The caller must have Setattr permission to change keyring restrictions.
  *
  * The requested type name may be a NULL pointer to reject all attempts
- * to link to the keyring. If _type is non-NULL, _restriction can be
+ * to link to the keyring.  In this case, _restriction must also be NULL.
- * NULL or a pointer to a string describing the restriction. If _type is
+ * Otherwise, both _type and _restriction must be non-NULL.
- * NULL, _restriction must also be NULL.
  *
  * Returns 0 if successful.
  */
 			     const char __user *_restriction)
 {
 	key_ref_t key_ref;
-	bool link_reject = !_type;
 	char type[32];
 	char *restriction = NULL;
 	long ret;
 	if (IS_ERR(key_ref))
 		return PTR_ERR(key_ref);
+	ret = -EINVAL;
 	if (_type) {
-		ret = key_get_type_from_user(type, _type, sizeof(type));
+		if (!_restriction)
-		if (ret < 0)
 			goto error;
-	}
-	if (_restriction) {
+		ret = key_get_type_from_user(type, _type, sizeof(type));
-		if (!_type) {
+		if (ret < 0)
-			ret = -EINVAL;
 			goto error;
-		}
 		restriction = strndup_user(_restriction, PAGE_SIZE);
 		if (IS_ERR(restriction)) {
 			ret = PTR_ERR(restriction);
 			goto error;
 		}
+	} else {
+		if (_restriction)
+			goto error;
 	}
-	ret = keyring_restrict(key_ref, link_reject ? NULL : type, restriction);
+	ret = keyring_restrict(key_ref, _type ? type : NULL, restriction);
 	kfree(restriction);
 error:
 	key_ref_put(key_ref);
 	return ret;
 }

security/keys/request_key.c+37−11

  * The keyring selected is returned with an extra reference upon it which the
  * caller must release.
  */
-static void construct_get_dest_keyring(struct key **_dest_keyring)
+static int construct_get_dest_keyring(struct key **_dest_keyring)
 {
 	struct request_key_auth *rka;
 	const struct cred *cred = current_cred();
 	struct key *dest_keyring = *_dest_keyring, *authkey;
+	int ret;
 	kenter("%p", dest_keyring);
 		/* the caller supplied one */
 		key_get(dest_keyring);
 	} else {
+		bool do_perm_check = true;
 		/* use a default keyring; falling through the cases until we
 		 * find one that we actually have */
 		switch (cred->jit_keyring) {
 					dest_keyring =
 						key_get(rka->dest_keyring);
 				up_read(&authkey->sem);
-				if (dest_keyring)
+				if (dest_keyring) {
+					do_perm_check = false;
 					break;
+				}
 			}
 		case KEY_REQKEY_DEFL_THREAD_KEYRING:
 		default:
 			BUG();
 		}
+		/*
+		 * Require Write permission on the keyring.  This is essential
+		 * because the default keyring may be the session keyring, and
+		 * joining a keyring only requires Search permission.
+		 *
+		 * However, this check is skipped for the "requestor keyring" so
+		 * that /sbin/request-key can itself use request_key() to add
+		 * keys to the original requestor's destination keyring.
+		 */
+		if (dest_keyring && do_perm_check) {
+			ret = key_permission(make_key_ref(dest_keyring, 1),
+					     KEY_NEED_WRITE);
+			if (ret) {
+				key_put(dest_keyring);
+				return ret;
+			}
+		}
 	}
 	*_dest_keyring = dest_keyring;
 	kleave(" [dk %d]", key_serial(dest_keyring));
-	return;
+	return 0;
 }
 /*
 	if (ctx->index_key.type == &key_type_keyring)
 		return ERR_PTR(-EPERM);
-	user = key_user_lookup(current_fsuid());
+	ret = construct_get_dest_keyring(&dest_keyring);
-	if (!user)
+	if (ret)
-		return ERR_PTR(-ENOMEM);
+		goto error;
-	construct_get_dest_keyring(&dest_keyring);
+	user = key_user_lookup(current_fsuid());
+	if (!user) {
+		ret = -ENOMEM;
+		goto error_put_dest_keyring;
+	}
 	ret = construct_alloc_key(ctx, dest_keyring, flags, user, &key);
 	key_user_put(user);
 	} else if (ret == -EINPROGRESS) {
 		ret = 0;
 	} else {
-		goto couldnt_alloc_key;
+		goto error_put_dest_keyring;
 	}
 	key_put(dest_keyring);
 construction_failed:
 	key_negate_and_link(key, key_negative_timeout, NULL, NULL);
 	key_put(key);
-couldnt_alloc_key:
+error_put_dest_keyring:
 	key_put(dest_keyring);
+error:
 	kleave(" = %d", ret);
 	return ERR_PTR(ret);
 }
 	if (!IS_ERR(key_ref)) {
 		key = key_ref_to_ptr(key_ref);
 		if (dest_keyring) {
-			construct_get_dest_keyring(&dest_keyring);
 			ret = key_link(dest_keyring, key);
-			key_put(dest_keyring);
 			if (ret < 0) {
 				key_put(key);
 				key = ERR_PTR(ret);