From patchwork Mon Sep 18 18:36:31 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eric Biggers X-Patchwork-Id: 9957373 Return-Path: Received: from mail.wl.linuxfoundation.org (pdx-wl-mail.web.codeaurora.org [172.30.200.125]) by pdx-korg-patchwork.web.codeaurora.org (Postfix) with ESMTP id EA4BA60385 for ; Mon, 18 Sep 2017 18:36:41 +0000 (UTC) Received: from mail.wl.linuxfoundation.org (localhost [127.0.0.1]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id DE05928C1E for ; Mon, 18 Sep 2017 18:36:41 +0000 (UTC) Received: by mail.wl.linuxfoundation.org (Postfix, from userid 486) id CF69E28D3B; Mon, 18 Sep 2017 18:36:41 +0000 (UTC) X-Spam-Checker-Version: SpamAssassin 3.3.1 (2010-03-16) on pdx-wl-mail.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-6.8 required=2.0 tests=BAYES_00, DKIM_ADSP_CUSTOM_MED, DKIM_SIGNED, FREEMAIL_FROM, RCVD_IN_DNSWL_HI, T_DKIM_INVALID autolearn=ham version=3.3.1 Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.wl.linuxfoundation.org (Postfix) with ESMTP id 7C1D128C1E for ; Mon, 18 Sep 2017 18:36:41 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755850AbdIRSgk (ORCPT ); Mon, 18 Sep 2017 14:36:40 -0400 Received: from mail-pf0-f196.google.com ([209.85.192.196]:36556 "EHLO mail-pf0-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754019AbdIRSgj (ORCPT ); Mon, 18 Sep 2017 14:36:39 -0400 Received: by mail-pf0-f196.google.com with SMTP id f84so514426pfj.3; Mon, 18 Sep 2017 11:36:39 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=from:to:cc:subject:date:message-id; bh=susfYyG+HhQTn/fANZEmmW6rlVP5qWTvHwsEqhkxIlU=; b=T0EsXRE9w3/Muum+YxE149wRUDIZ8wEZ53ojS29iqdR2vwZpQzJquSNxUP2PMu6fj9 GXs3H1vJSxPWpP3xdJTJZ1g1wNHK10YQ6VtMzBKRqpqS0QgRoEjNI9Zj256ky1oGts6s 03Uoev7nysi8U57fJOHMZxNpa6AnWZ1bx7Ooj8EY+oruhbbUTNHOiWFUZy0qHJvKixNU ZDh2M+CsfCXZKsb8aMgj07aBgqyVJKY/onhGu2B5epwpxFOXbVMzrWebNJvBFtN6ORoK EqqyYHutPo8czwBqaNf+/FFNHL3xe+ONw/YT2asxRkhJRJ2uTUu06HpyG7/4nifZlioI 0lmQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=susfYyG+HhQTn/fANZEmmW6rlVP5qWTvHwsEqhkxIlU=; b=IqX9ftNrhcML3NdeseBsr2BkHRwKpW7HKZHQqI9lhoVhGP/0r8gYErXrbwPIHADtvn wtKbdnLQR773DHODXGUmpUOLAHGLqrlFMsbvXOr2xM5xtpPxOwJw6jERjx5hspuHyE2j pcqYkuyHzZzS761Lxkq/5NT/bPzFM0zaUmcv+PCSVkPdYmP4e1iquSqXnBe6/VGCWJ5D R1ET8MxailxAP4jk2n2mCvKglQ1UR54gTslpB3v8EEeguAF2swutLVD3KZX4rSeVcEIo Pe5bhxq8/aqMALys48/1UAI7EbUmmeZQ+9/Bg7yd30hA2jb2NLpyMgYkrHvGGbXLiEXF OQ5w== X-Gm-Message-State: AHPjjUhtzWMO44RFrDG2p+zhBCqa6fqLnQCY4CtG5X8bPlkldVmiDktD HSr3cXdcBGmRlMx9oSI= X-Google-Smtp-Source: ADKCNb4kwpedYH6rW7XGI1yEWPMdnluKlC7Upt3lFx3Rary+3pr0jpL3RnqJ3K/06Re/EP+bspihuA== X-Received: by 10.99.126.84 with SMTP id o20mr32529314pgn.183.1505759798673; Mon, 18 Sep 2017 11:36:38 -0700 (PDT) Received: from ebiggers-linuxstation.kir.corp.google.com ([100.66.174.81]) by smtp.gmail.com with ESMTPSA id p63sm64522pga.82.2017.09.18.11.36.38 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 18 Sep 2017 11:36:38 -0700 (PDT) From: Eric Biggers To: keyrings@vger.kernel.org Cc: David Howells , Michael Halcrow , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Biggers Subject: [PATCH] KEYS: fix key refcount leak in keyctl_read_key() Date: Mon, 18 Sep 2017 11:36:31 -0700 Message-Id: <20170918183631.113991-1-ebiggers3@gmail.com> X-Mailer: git-send-email 2.14.1.690.gbb1197296e-goog Sender: owner-linux-security-module@vger.kernel.org Precedence: bulk List-ID: X-Virus-Scanned: ClamAV using ClamSMTP From: Eric Biggers In keyctl_read_key(), if key_permission() were to return an error code other than EACCES, we would leak a the reference to the key. This can't actually happen currently because key_permission() can only return an error code other than EACCES if security_key_permission() does, only SELinux and Smack implement that hook, and neither can return an error code other than EACCES. But it should still be fixed, as it is a bug waiting to happen. Fixes: 29db91906340 ("[PATCH] Keys: Add LSM hooks for key management [try #3]") Signed-off-by: Eric Biggers --- security/keys/keyctl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c index 552e4460683b..365ff85d7e27 100644 --- a/security/keys/keyctl.c +++ b/security/keys/keyctl.c @@ -776,7 +776,7 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen) if (ret == 0) goto can_read_key; if (ret != -EACCES) - goto error; + goto error2; /* we can't; see if it's searchable from this process's keyrings * - we automatically take account of the fact that it may be