On Mon, Dec 31, 2018 at 2:45 PM Eric Biggers wrote:
>
> KEYCTL_PKEY_QUERY is still failing basic fuzzing even after Linus' fix that
> changed Opt_err from -1 to 0. The crash is still in
> keyctl_pkey_params_parse():
>
> token = match_token(p, param_keys, args);
>
Hi David and Linus,
On Mon, Dec 17, 2018 at 12:02:01PM -0800, Linus Torvalds wrote:
> On Mon, Dec 17, 2018 at 11:51 AM James Bottomley
> wrote:
> >
> > If this is to replace Eric's patch, didn't you want to set token_mask
> > to (1<
> No, let's not add any extra code that is trying to be subtle.
On Mon, Dec 17, 2018 at 7:43 PM Linus Torvalds
wrote:
>
> On Mon, Dec 17, 2018 at 10:13 AM Eric Biggers wrote:
> >
> > Hi Linus, please consider applying this patch. It's been ignored by the
> > keyrings maintainer for a month and a half with multiple reminders. It
> > fixes an easily reachable
On Mon, 2018-12-17 at 12:02 -0800, Linus Torvalds wrote:
> On Mon, Dec 17, 2018 at 11:51 AM James Bottomley
> wrote:
> >
> > If this is to replace Eric's patch, didn't you want to set
> > token_mask to (1<
> No, let's not add any extra code that is trying to be subtle. Subtle
> interactions was
On Mon, Dec 17, 2018 at 12:21 PM Mimi Zohar wrote:
>
> It's being used for parsing and displaying the policy, which do need
> to be in sync.
Yes, but it needs a comment somewhere.
Also, the way you use those enums as array indices also implies that
for your case, Opt_err should definitely not be
On Mon, 2018-12-17 at 12:02 -0800, Linus Torvalds wrote:
> Talking about the conflicting ones: Opt_hash checks that
> Opt_policydigest isn't set. But Opt_policydigest doesn't check that
> Opt_hash isn't set, so you can mix the two if you just do it in the
> right order.
>
> But that's a separate b
On Mon, 2018-12-17 at 11:06 -0800, Linus Torvalds wrote:
> On Mon, Dec 17, 2018 at 10:49 AM Linus Torvalds
> wrote:
> >
> > So the *simplest* fix would seem to be to literally remove all those
> > "= -1" for the Opt_err initialization. Making the code smaller,
> > simpler, and fixing the bug in t
On Mon, Dec 17, 2018 at 11:51 AM James Bottomley
wrote:
>
> If this is to replace Eric's patch, didn't you want to set token_mask
> to (1<
On Mon, 2018-12-17 at 11:39 -0800, Linus Torvalds wrote:
> On Mon, Dec 17, 2018 at 11:06 AM Linus Torvalds
> wrote:
> >
> > Honestly, for being about "security", all of this code seems to be
> > doing some really questionable things with all those Opt_xyz enums.
>
> Yeah, at least security/keys/
On Mon, Dec 17, 2018 at 11:06 AM Linus Torvalds
wrote:
>
> Honestly, for being about "security", all of this code seems to be
> doing some really questionable things with all those Opt_xyz enums.
Yeah, at least security/keys/trusted.c ends up mixing that enum and
just using "int" completely rando
On Mon, Dec 17, 2018 at 10:49 AM Linus Torvalds
wrote:
>
> So the *simplest* fix would seem to be to literally remove all those
> "= -1" for the Opt_err initialization. Making the code smaller,
> simpler, and fixing the bug in the process.
Something like this
git grep -l 'Opt_err = -1' | x
On Mon, Dec 17, 2018 at 10:43 AM Linus Torvalds
wrote:
>
> Or maybe just remove it entirely, since it's clearly entirely
> incorrect from the very start.
.. or another alternative: remove the "Opt_err = -1" entirely.
Again, this seems to be a buggy pattern exclusive to the security
code. Nobody
On Mon, Dec 17, 2018 at 10:13 AM Eric Biggers wrote:
>
> Hi Linus, please consider applying this patch. It's been ignored by the
> keyrings maintainer for a month and a half with multiple reminders. It
> fixes an easily reachable stack corruption in the new keyctl operations
> that were added in
From: Eric Biggers
We need to check the return value of match_token() for Opt_err (-1)
before doing anything with it.
Reported-by: syzbot+a22e0dc07567662c5...@syzkaller.appspotmail.com
Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for
asymmetric keys [ver #2]")
Cc: D
14 matches
Mail list logo
