Eric Lee / smarc-fsl-linux-kernel

13 Jun, 2018

1 commit

  • 6da2ec560   treewide: kmalloc() -> kmalloc_array() ... Browse Code »

    The kmalloc() function has a 2-factor argument form, kmalloc_array(). This
    patch replaces cases of:

    kmalloc(a * b, gfp)

    with:
    kmalloc_array(a * b, gfp)

    as well as handling cases of:

    kmalloc(a * b * c, gfp)

    with:

    kmalloc(array3_size(a, b, c), gfp)

    as it's slightly less ugly than:

    kmalloc_array(array_size(a, b), c, gfp)

    This does, however, attempt to ignore constant size factors like:

    kmalloc(4 * 1024, gfp)

    though any constants defined via macros get caught up in the conversion.

    Any factors with a sizeof() of "unsigned char", "char", and "u8" were
    dropped, since they're redundant.

    The tools/ directory was manually excluded, since it has its own
    implementation of kmalloc().

    The Coccinelle script used for this was:

    // Fix redundant parens around sizeof().
    @@
    type TYPE;
    expression THING, E;
    @@

    (
    kmalloc(
    - (sizeof(TYPE)) * E
    + sizeof(TYPE) * E
    , ...)
    |
    kmalloc(
    - (sizeof(THING)) * E
    + sizeof(THING) * E
    , ...)
    )

    // Drop single-byte sizes and redundant parens.
    @@
    expression COUNT;
    typedef u8;
    typedef __u8;
    @@

    (
    kmalloc(
    - sizeof(u8) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(__u8) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(char) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(unsigned char) * (COUNT)
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(u8) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(__u8) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(char) * COUNT
    + COUNT
    , ...)
    |
    kmalloc(
    - sizeof(unsigned char) * COUNT
    + COUNT
    , ...)
    )

    // 2-factor product with sizeof(type/expression) and identifier or constant.
    @@
    type TYPE;
    expression THING;
    identifier COUNT_ID;
    constant COUNT_CONST;
    @@

    (
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (COUNT_ID)
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * COUNT_ID
    + COUNT_ID, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (COUNT_CONST)
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * COUNT_CONST
    + COUNT_CONST, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (COUNT_ID)
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * COUNT_ID
    + COUNT_ID, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (COUNT_CONST)
    + COUNT_CONST, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * COUNT_CONST
    + COUNT_CONST, sizeof(THING)
    , ...)
    )

    // 2-factor product, only identifiers.
    @@
    identifier SIZE, COUNT;
    @@

    - kmalloc
    + kmalloc_array
    (
    - SIZE * COUNT
    + COUNT, SIZE
    , ...)

    // 3-factor product with 1 sizeof(type) or sizeof(expression), with
    // redundant parens removed.
    @@
    expression THING;
    identifier STRIDE, COUNT;
    type TYPE;
    @@

    (
    kmalloc(
    - sizeof(TYPE) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(TYPE))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * (COUNT) * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * (COUNT) * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * COUNT * (STRIDE)
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    |
    kmalloc(
    - sizeof(THING) * COUNT * STRIDE
    + array3_size(COUNT, STRIDE, sizeof(THING))
    , ...)
    )

    // 3-factor product with 2 sizeof(variable), with redundant parens removed.
    @@
    expression THING1, THING2;
    identifier COUNT;
    type TYPE1, TYPE2;
    @@

    (
    kmalloc(
    - sizeof(TYPE1) * sizeof(TYPE2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(TYPE2))
    , ...)
    |
    kmalloc(
    - sizeof(THING1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(THING1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(THING1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * COUNT
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    |
    kmalloc(
    - sizeof(TYPE1) * sizeof(THING2) * (COUNT)
    + array3_size(COUNT, sizeof(TYPE1), sizeof(THING2))
    , ...)
    )

    // 3-factor product, only identifiers, with redundant parens removed.
    @@
    identifier STRIDE, SIZE, COUNT;
    @@

    (
    kmalloc(
    - (COUNT) * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * (STRIDE) * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * STRIDE * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - (COUNT) * (STRIDE) * (SIZE)
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    |
    kmalloc(
    - COUNT * STRIDE * SIZE
    + array3_size(COUNT, STRIDE, SIZE)
    , ...)
    )

    // Any remaining multi-factor products, first at least 3-factor products,
    // when they're not all constants...
    @@
    expression E1, E2, E3;
    constant C1, C2, C3;
    @@

    (
    kmalloc(C1 * C2 * C3, ...)
    |
    kmalloc(
    - (E1) * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - (E1) * (E2) * E3
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - (E1) * (E2) * (E3)
    + array3_size(E1, E2, E3)
    , ...)
    |
    kmalloc(
    - E1 * E2 * E3
    + array3_size(E1, E2, E3)
    , ...)
    )

    // And then all remaining 2 factors products when they're not all constants,
    // keeping sizeof() as the second factor argument.
    @@
    expression THING, E1, E2;
    type TYPE;
    constant C1, C2, C3;
    @@

    (
    kmalloc(sizeof(THING) * C2, ...)
    |
    kmalloc(sizeof(TYPE) * C2, ...)
    |
    kmalloc(C1 * C2 * C3, ...)
    |
    kmalloc(C1 * C2, ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * (E2)
    + E2, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(TYPE) * E2
    + E2, sizeof(TYPE)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * (E2)
    + E2, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - sizeof(THING) * E2
    + E2, sizeof(THING)
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - (E1) * E2
    + E1, E2
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - (E1) * (E2)
    + E1, E2
    , ...)
    |
    - kmalloc
    + kmalloc_array
    (
    - E1 * E2
    + E1, E2
    , ...)
    )

    Signed-off-by: Kees Cook

    Kees Cook
     

28 Jan, 2018

1 commit

13 May, 2017

1 commit

15 Oct, 2016

1 commit

  • 3514de3fd   CIFS: Retrieve uid and gid from special sid if enabled ... Browse Code »

    New mount option "idsfromsid" indicates to cifs.ko that
    it should try to retrieve the uid and gid owner fields
    from special sids. This patch adds the code to parse the owner
    sids in the ACL to see if they match, and if so populate the
    uid and/or gid from them. This is faster than upcalling for
    them and asking winbind, and is a fairly common case, and is
    also helpful when cifs.upcall and idmapping is not configured.

    Signed-off-by: Steve French
    Reviewed-by: Shirish Pargaonkar
    Reviewed-by: Jeff Layton
    Reviewed-by: Pavel Shilovsky

    Steve French
     

12 Apr, 2016

1 commit

  • 5ac7eace2   KEYS: Add a facility to restrict new links into a keyring ... Browse Code »

    Add a facility whereby proposed new links to be added to a keyring can be
    vetted, permitting them to be rejected if necessary. This can be used to
    block public keys from which the signature cannot be verified or for which
    the signature verification fails. It could also be used to provide
    blacklisting.

    This affects operations like add_key(), KEYCTL_LINK and KEYCTL_INSTANTIATE.

    To this end:

    (1) A function pointer is added to the key struct that, if set, points to
    the vetting function. This is called as:

    int (*restrict_link)(struct key *keyring,
    const struct key_type *key_type,
    unsigned long key_flags,
    const union key_payload *key_payload),

    where 'keyring' will be the keyring being added to, key_type and
    key_payload will describe the key being added and key_flags[*] can be
    AND'ed with KEY_FLAG_TRUSTED.

    [*] This parameter will be removed in a later patch when
    KEY_FLAG_TRUSTED is removed.

    The function should return 0 to allow the link to take place or an
    error (typically -ENOKEY, -ENOPKG or -EKEYREJECTED) to reject the
    link.

    The pointer should not be set directly, but rather should be set
    through keyring_alloc().

    Note that if called during add_key(), preparse is called before this
    method, but a key isn't actually allocated until after this function
    is called.

    (2) KEY_ALLOC_BYPASS_RESTRICTION is added. This can be passed to
    key_create_or_update() or key_instantiate_and_link() to bypass the
    restriction check.

    (3) KEY_FLAG_TRUSTED_ONLY is removed. The entire contents of a keyring
    with this restriction emplaced can be considered 'trustworthy' by
    virtue of being in the keyring when that keyring is consulted.

    (4) key_alloc() and keyring_alloc() take an extra argument that will be
    used to set restrict_link in the new key. This ensures that the
    pointer is set before the key is published, thus preventing a window
    of unrestrictedness. Normally this argument will be NULL.

    (5) As a temporary affair, keyring_restrict_trusted_only() is added. It
    should be passed to keyring_alloc() as the extra argument instead of
    setting KEY_FLAG_TRUSTED_ONLY on a keyring. This will be replaced in
    a later patch with functions that look in the appropriate places for
    authoritative keys.

    Signed-off-by: David Howells
    Reviewed-by: Mimi Zohar

    David Howells
     

21 Oct, 2015

1 commit

  • 146aa8b14   KEYS: Merge the type-specific data with the payload data ... Browse Code »

    Merge the type-specific data with the payload data into one four-word chunk
    as it seems pointless to keep them separate.

    Use user_key_payload() for accessing the payloads of overloaded
    user-defined keys.

    Signed-off-by: David Howells
    cc: linux-cifs@vger.kernel.org
    cc: ecryptfs@vger.kernel.org
    cc: linux-ext4@vger.kernel.org
    cc: linux-f2fs-devel@lists.sourceforge.net
    cc: linux-nfs@vger.kernel.org
    cc: ceph-devel@vger.kernel.org
    cc: linux-ima-devel@lists.sourceforge.net

    David Howells
     

11 Dec, 2014

1 commit

17 Sep, 2014

1 commit

  • c06cfb08b   KEYS: Remove key_type::match in favour of overriding default by match_preparse ... Browse Code »

    A previous patch added a ->match_preparse() method to the key type. This is
    allowed to override the function called by the iteration algorithm.
    Therefore, we can just set a default that simply checks for an exact match of
    the key description with the original criterion data and allow match_preparse
    to override it as needed.

    The key_type::match op is then redundant and can be removed, as can the
    user_match() function.

    Signed-off-by: David Howells
    Acked-by: Vivek Goyal

    David Howells
     

11 Feb, 2014

1 commit

  • 42eacf9e5   [CIFS] Fix cifsacl mounts over smb2 to not call cifs ... Browse Code »

    When mounting with smb2/smb3 (e.g. vers=2.1) and cifsacl mount option,
    it was trying to get the mode by querying the acl over the cifs
    rather than smb2 protocol. This patch makes that protocol
    independent and makes cifsacl smb2 mounts return a more intuitive
    operation not supported error (until we add a worker function
    for smb2_get_acl).

    Note that a previous patch fixed getxattr/setxattr for the CIFSACL xattr
    which would unconditionally call cifs_get_acl and cifs_set_acl (even when
    mounted smb2). I made those protocol independent last week (new protocol
    version operations "get_acl" and "set_acl" but did not add an
    smb2_get_acl and smb2_set_acl yet so those now simply return EOPNOTSUPP
    which at least is better than sending cifs requests on smb2 mount)

    The previous patches did not fix the one remaining case though ie
    mounting with "cifsacl" when getting mode from acl would unconditionally
    end up calling "cifs_get_acl_from_fid" even for smb2 - so made that protocol
    independent but to make that protocol independent had to make sure that the callers
    were passing the protocol independent handle structure (cifs_fid) instead
    of cifs specific _u16 network file handle (ie cifs_fid instead of cifs_fid->fid)

    Now mount with smb2 and cifsacl mount options will return EOPNOTSUP (instead
    of timing out) and a future patch will add smb2 operations (e.g. get_smb2_acl)
    to enable this.

    Signed-off-by: Steve French

    Steve French
     

08 Feb, 2014

1 commit

  • 83e3bc23e   retrieving CIFS ACLs when mounted with SMB2 fails dropping session ... Browse Code »

    The get/set ACL xattr support for CIFS ACLs attempts to send old
    cifs dialect protocol requests even when mounted with SMB2 or later
    dialects. Sending cifs requests on an smb2 session causes problems -
    the server drops the session due to the illegal request.

    This patch makes CIFS ACL operations protocol specific to fix that.

    Attempting to query/set CIFS ACLs for SMB2 will now return
    EOPNOTSUPP (until we add worker routines for sending query
    ACL requests via SMB2) instead of sending invalid (cifs)
    requests.

    A separate followon patch will be needed to fix cifs_acl_to_fattr
    (which takes a cifs specific u16 fid so can't be abstracted
    to work with SMB2 until that is changed) and will be needed
    to fix mount problems when "cifsacl" is specified on mount
    with e.g. vers=2.1

    Signed-off-by: Steve French
    Reviewed-by: Shirish Pargaonkar
    CC: Stable

    Steve French
     

20 Jan, 2014

1 commit

05 May, 2013

2 commits

  • f96637be0   [CIFS] cifs: Rename cERROR and cFYI to cifs_dbg ... Browse Code »

    It's not obvious from reading the macro names that these macros
    are for debugging. Convert the names to a single more typical
    kernel style cifs_dbg macro.

    cERROR(1, ...) -> cifs_dbg(VFS, ...)
    cFYI(1, ...) -> cifs_dbg(FYI, ...)
    cFYI(DBG2, ...) -> cifs_dbg(NOISY, ...)

    Move the terminating format newline from the macro to the call site.

    Add CONFIG_CIFS_DEBUG function cifs_vfs_err to emit the
    "CIFS VFS: " prefix for VFS messages.

    Size is reduced ~ 1% when CONFIG_CIFS_DEBUG is set (default y)

    $ size fs/cifs/cifs.ko*
    text data bss dec hex filename
    265245 2525 132 267902 4167e fs/cifs/cifs.ko.new
    268359 2525 132 271016 422a8 fs/cifs/cifs.ko.old

    Other miscellaneous changes around these conversions:

    o Miscellaneous typo fixes
    o Add terminating \n's to almost all formats and remove them
    from the macros to be more kernel style like. A few formats
    previously had defective \n's
    o Remove unnecessary OOM messages as kmalloc() calls dump_stack
    o Coalesce formats to make grep easier,
    added missing spaces when coalescing formats
    o Use %s, __func__ instead of embedded function name
    o Removed unnecessary "cifs: " prefixes
    o Convert kzalloc with multiply to kcalloc
    o Remove unused cifswarn macro

    Signed-off-by: Joe Perches
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Joe Perches
     
  • f7f7c1850   fs: cifs: use kmemdup instead of kmalloc + memcpy ... Browse Code »

    This replaces calls to kmalloc followed by memcpy with a single call to
    kmemdup. This was found via make coccicheck.

    Signed-off-by: Silviu-Mihai Popescu
    Signed-off-by: Steve French
    Signed-off-by: Steve French

    Silviu-Mihai Popescu
     

13 Feb, 2013

3 commits

17 Dec, 2012

1 commit

  • 2a74dbb9a   Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security ... Browse Code »

    Pull security subsystem updates from James Morris:
    "A quiet cycle for the security subsystem with just a few maintenance
    updates."

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
    Smack: create a sysfs mount point for smackfs
    Smack: use select not depends in Kconfig
    Yama: remove locking from delete path
    Yama: add RCU to drop read locking
    drivers/char/tpm: remove tasklet and cleanup
    KEYS: Use keyring_alloc() to create special keyrings
    KEYS: Reduce initial permissions on keys
    KEYS: Make the session and process keyrings per-thread
    seccomp: Make syscall skipping and nr changes more consistent
    key: Fix resource leak
    keys: Fix unreachable code
    KEYS: Add payload preparsing opportunity prior to key instantiate or update

    Linus Torvalds
     

12 Dec, 2012

1 commit

  • 193cdd8a2   cifs: fix SID binary to string conversion ... Browse Code »

    The authority fields are supposed to be represented by a single 48-bit
    value. It's also supposed to represent the value as hex if it's equal to
    or greater than 2^32. This is documented in MS-DTYP, section 2.4.2.1.

    Also, fix up the max string length to account for this fix.

    Acked-by: Pavel Shilovsky
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     

09 Dec, 2012

5 commits

  • 1f6306806   cifs: deal with id_to_sid embedded sid reply corner case ... Browse Code »

    A SID could potentially be embedded inside of payload.value if there are
    no subauthorities, and the arch has 8 byte pointers. Allow for that
    possibility there.

    While we're at it, rephrase the "embedding" check in terms of
    key->payload to allow for the possibility that the union might change
    size in the future.

    Reviewed-by: Shirish Pargaonkar
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     
  • 7ee0b4c63   cifs: fix hardcoded default security descriptor length ... Browse Code »

    It was hardcoded to 192 bytes, which was not enough when the max number
    of subauthorities went to 15. Redefine this constant in terms of sizeof
    the structs involved, and rename it for better clarity.

    While we're at it, remove a couple more unused constants from cifsacl.h.

    Reviewed-by: Shirish Pargaonkar
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     
  • 2ae03025d   cifs: extra sanity checking for cifs.idmap keys ... Browse Code »

    Now that we aren't so rigid about the length of the key being passed
    in, we need to be a bit more rigorous about checking the length of
    the actual data against the claimed length (a'la num_subauths field).

    Check for the case where userspace sends us a seemingly valid key
    with a num_subauths field that goes beyond the end of the array. If
    that happens, return -EIO and invalidate the key.

    Also change the other places where we check for malformed keys in this
    code to invalidate the key as well.

    Reviewed-by: Shirish Pargaonkar
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     
  • 41a9f1f6b   cifs: avoid extra allocation for small cifs.idmap keys ... Browse Code »

    The cifs.idmap keytype always allocates memory to hold the payload from
    userspace. In the common case where we're translating a SID to a UID or
    GID, we're allocating memory to hold something that's less than or equal
    to the size of a pointer.

    When the payload is the same size as a pointer or smaller, just store
    it in the payload.value union member instead. That saves us an extra
    allocation on the sid_to_id upcall.

    Note that we have to take extra care to check the datalen when we
    go to dereference the .data pointer in the union, but the callers
    now check that as a matter of course anyway.

    Reviewed-by: Shirish Pargaonkar
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     
  • faa65f07d   cifs: simplify id_to_sid and sid_to_id mapping code ... Browse Code »

    The cifs.idmap handling code currently causes the kernel to cache the
    data from userspace twice. It first looks in a rbtree to see if there is
    a matching entry for the given id. If there isn't then it calls
    request_key which then checks its cache and then calls out to userland
    if it doesn't have one. If the userland program establishes a mapping
    and downcalls with that info, it then gets cached in the keyring and in
    this rbtree.

    Aside from the double memory usage and the performance penalty in doing
    all of these extra copies, there are some nasty bugs in here too. The
    code declares four rbtrees and spinlocks to protect them, but only seems
    to use two of them. The upshot is that the same tree is used to hold
    (eg) uid:sid and sid:uid mappings. The comparitors aren't equipped to
    deal with that.

    I think we'd be best off to remove a layer of caching in this code. If
    this was originally done for performance reasons, then that really seems
    like a premature optimization.

    This patch does that -- it removes the rbtrees and the locks that
    protect them and simply has the code do a request_key call on each call
    into sid_to_id and id_to_sid. This greatly simplifies this code and
    should roughly halve the memory utilization from using the idmapping
    code.

    Reviewed-by: Shirish Pargaonkar
    Signed-off-by: Jeff Layton
    Signed-off-by: Steve French

    Jeff Layton
     

06 Dec, 2012

8 commits

03 Nov, 2012

1 commit

  • 36960e440   cifs: fix potential buffer overrun in cifs.idmap handling code ... Browse Code »

    The userspace cifs.idmap program generally works with the wbclient libs
    to generate binary SIDs in userspace. That program defines the struct
    that holds these values as having a max of 15 subauthorities. The kernel
    idmapping code however limits that value to 5.

    When the kernel copies those values around though, it doesn't sanity
    check the num_subauths value handed back from userspace or from the
    server. It's possible therefore for userspace to hand us back a bogus
    num_subauths value (or one that's valid, but greater than 5) that could
    cause the kernel to walk off the end of the cifs_sid->sub_auths array.

    Fix this by defining a new routine for copying sids and using that in
    all of the places that copy it. If we end up with a sid that's longer
    than expected then this approach will just lop off the "extra" subauths,
    but that's basically what the code does today already. Better approaches
    might be to fix this code to reject SIDs with >5 subauths, or fix it
    to handle the subauths array dynamically.

    At the same time, change the kernel to check the length of the data
    returned by userspace. If it's shorter than struct cifs_sid, reject it
    and return -EIO. If that happens we'll end up with fields that are
    basically uninitialized.

    Long term, it might make sense to redefine cifs_sid using a flexarray at
    the end, to allow for variable-length subauth lists, and teach the code
    to handle the case where the subauths array being passed in from
    userspace is shorter than 5 elements.

    Note too, that I don't consider this a security issue since you'd need
    a compromised cifs.idmap program. If you have that, you can do all sorts
    of nefarious stuff. Still, this is probably reasonable for stable.

    Cc: stable@kernel.org
    Reviewed-by: Shirish Pargaonkar
    Signed-off-by: Jeff Layton

    Jeff Layton
     

15 Oct, 2012

1 commit

  • d25282d1c   Merge branch 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux ... Browse Code »

    Pull module signing support from Rusty Russell:
    "module signing is the highlight, but it's an all-over David Howells frenzy..."

    Hmm "Magrathea: Glacier signing key". Somebody has been reading too much HHGTTG.

    * 'modules-next' of git://git.kernel.org/pub/scm/linux/kernel/git/rusty/linux: (37 commits)
    X.509: Fix indefinite length element skip error handling
    X.509: Convert some printk calls to pr_devel
    asymmetric keys: fix printk format warning
    MODSIGN: Fix 32-bit overflow in X.509 certificate validity date checking
    MODSIGN: Make mrproper should remove generated files.
    MODSIGN: Use utf8 strings in signer's name in autogenerated X.509 certs
    MODSIGN: Use the same digest for the autogen key sig as for the module sig
    MODSIGN: Sign modules during the build process
    MODSIGN: Provide a script for generating a key ID from an X.509 cert
    MODSIGN: Implement module signature checking
    MODSIGN: Provide module signing public keys to the kernel
    MODSIGN: Automatically generate module signing keys if missing
    MODSIGN: Provide Kconfig options
    MODSIGN: Provide gitignore and make clean rules for extra files
    MODSIGN: Add FIPS policy
    module: signature checking hook
    X.509: Add a crypto key parser for binary (DER) X.509 certificates
    MPILIB: Provide a function to read raw data into an MPI
    X.509: Add an ASN.1 decoder
    X.509: Add simple ASN.1 grammar compiler
    ...

    Linus Torvalds
     

08 Oct, 2012

1 commit

  • cf7f601c0   KEYS: Add payload preparsing opportunity prior to key instantiate or update ... Browse Code »

    Give the key type the opportunity to preparse the payload prior to the
    instantiation and update routines being called. This is done with the
    provision of two new key type operations:

    int (*preparse)(struct key_preparsed_payload *prep);
    void (*free_preparse)(struct key_preparsed_payload *prep);

    If the first operation is present, then it is called before key creation (in
    the add/update case) or before the key semaphore is taken (in the update and
    instantiate cases). The second operation is called to clean up if the first
    was called.

    preparse() is given the opportunity to fill in the following structure:

    struct key_preparsed_payload {
    char *description;
    void *type_data[2];
    void *payload;
    const void *data;
    size_t datalen;
    size_t quotalen;
    };

    Before the preparser is called, the first three fields will have been cleared,
    the payload pointer and size will be stored in data and datalen and the default
    quota size from the key_type struct will be stored into quotalen.

    The preparser may parse the payload in any way it likes and may store data in
    the type_data[] and payload fields for use by the instantiate() and update()
    ops.

    The preparser may also propose a description for the key by attaching it as a
    string to the description field. This can be used by passing a NULL or ""
    description to the add_key() system call or the key_create_or_update()
    function. This cannot work with request_key() as that required the description
    to tell the upcall about the key to be created.

    This, for example permits keys that store PGP public keys to generate their own
    name from the user ID and public key fingerprint in the key.

    The instantiate() and update() operations are then modified to look like this:

    int (*instantiate)(struct key *key, struct key_preparsed_payload *prep);
    int (*update)(struct key *key, struct key_preparsed_payload *prep);

    and the new payload data is passed in *prep, whether or not it was preparsed.

    Signed-off-by: David Howells
    Signed-off-by: Rusty Russell

    David Howells
     

03 Oct, 2012

2 commits

25 Sep, 2012

1 commit

13 Sep, 2012

1 commit

  • d4f65b5d2   KEYS: Add payload preparsing opportunity prior to key instantiate or update ... Browse Code »

    Give the key type the opportunity to preparse the payload prior to the
    instantiation and update routines being called. This is done with the
    provision of two new key type operations:

    int (*preparse)(struct key_preparsed_payload *prep);
    void (*free_preparse)(struct key_preparsed_payload *prep);

    If the first operation is present, then it is called before key creation (in
    the add/update case) or before the key semaphore is taken (in the update and
    instantiate cases). The second operation is called to clean up if the first
    was called.

    preparse() is given the opportunity to fill in the following structure:

    struct key_preparsed_payload {
    char *description;
    void *type_data[2];
    void *payload;
    const void *data;
    size_t datalen;
    size_t quotalen;
    };

    Before the preparser is called, the first three fields will have been cleared,
    the payload pointer and size will be stored in data and datalen and the default
    quota size from the key_type struct will be stored into quotalen.

    The preparser may parse the payload in any way it likes and may store data in
    the type_data[] and payload fields for use by the instantiate() and update()
    ops.

    The preparser may also propose a description for the key by attaching it as a
    string to the description field. This can be used by passing a NULL or ""
    description to the add_key() system call or the key_create_or_update()
    function. This cannot work with request_key() as that required the description
    to tell the upcall about the key to be created.

    This, for example permits keys that store PGP public keys to generate their own
    name from the user ID and public key fingerprint in the key.

    The instantiate() and update() operations are then modified to look like this:

    int (*instantiate)(struct key *key, struct key_preparsed_payload *prep);
    int (*update)(struct key *key, struct key_preparsed_payload *prep);

    and the new payload data is passed in *prep, whether or not it was preparsed.

    Signed-off-by: David Howells

    David Howells
     

24 Jul, 2012

2 commits