Eric Biggers df5371592a KEYS: trusted: fix writing past end of buffer in trusted_read() ... commit a3c812f7cf upstream. When calling keyctl_read() on a key of type "trusted", if the user-supplied buffer was too small, the kernel ignored the buffer length and just wrote past the end of the buffer, potentially corrupting userspace memory. Fix it by instead returning the size required, as per the documentation for keyctl_read(). We also don't even fill the buffer at all in this case, as this is slightly easier to implement than doing a short read, and either behavior appears to be permitted. It also makes it match the behavior of the "encrypted" key type. Fixes: d00a1c72f7 ("keys: add new trusted key-type") Reported-by: Ben Hutchings <ben@decadent.org.uk> Signed-off-by: Eric Biggers <ebiggers@google.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Mimi Zohar <zohar@linux.vnet.ibm.com> Reviewed-by: James Morris <james.l.morris@oracle.com> Signed-off-by: James Morris <james.l.morris@oracle.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-11-15 17:13:11 +01:00
..
apparmor	apparmor: fix change_hat not finding hat after policy replacement	2016-12-02 09:09:01 +01:00
integrity	ima: accept previously set IMA_NEW_FILE	2017-05-25 14:30:09 +02:00
keys	KEYS: trusted: fix writing past end of buffer in trusted_read()	2017-11-15 17:13:11 +01:00
selinux	selinux: fix off-by-one in setprocattr	2017-02-14 15:22:50 -08:00
smack	lsm: fix smack_inode_removexattr and xattr_getsecurity memleak	2017-10-12 11:27:32 +02:00
tomoyo	LSM: Switch to lists of hooks	2015-05-12 15:00:41 +10:00
yama	security: let security modules use PTRACE_MODE_* with bitmasks	2016-03-03 15:07:32 -08:00
commoncap.c	ptrace: use fsuid, fsgid, effective creds for fs access checks	2016-02-25 12:01:16 -08:00
device_cgroup.c	security/device_cgroup: Fix RCU_LOCKDEP_WARN() condition	2015-09-03 18:13:10 -07:00
inode.c	Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2015-07-04 19:36:06 -07:00
Kconfig	Yama: remove needless CONFIG_SECURITY_YAMA_STACKED	2015-07-28 13:18:19 +10:00
lsm_audit.c	Merge branch 'next' of git://git.infradead.org/users/pcmoore/selinux into next	2015-08-15 13:29:57 +10:00
Makefile	LSM: Switch to lists of hooks	2015-05-12 15:00:41 +10:00
min_addr.c
security.c	Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2015-09-08 12:41:25 -07:00