linux-kernel - Re: [PATCH] KEYS: encrypted: Add check for strsep

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <CYS7OCDQ54WZ.3RS9IWCQG4Y5L@suppilovahvero>
Date: Tue, 30 Jan 2024 19:19:27 +0200
From: "Jarkko Sakkinen" <jarkko@...nel.org>
To: "Verma, Vishal L" <vishal.l.verma@...el.com>, "zohar@...ux.ibm.com"
 <zohar@...ux.ibm.com>, "paul@...l-moore.com" <paul@...l-moore.com>,
 "dhowells@...hat.com" <dhowells@...hat.com>, "yaelt@...gle.com"
 <yaelt@...gle.com>, "serge@...lyn.com" <serge@...lyn.com>,
 "nichen@...as.ac.cn" <nichen@...as.ac.cn>, "sumit.garg@...aro.org"
 <sumit.garg@...aro.org>, "jmorris@...ei.org" <jmorris@...ei.org>
Cc: "Jiang, Dave" <dave.jiang@...el.com>, "linux-integrity@...r.kernel.org"
 <linux-integrity@...r.kernel.org>, "linux-cxl@...r.kernel.org"
 <linux-cxl@...r.kernel.org>, "linux-kernel@...r.kernel.org"
 <linux-kernel@...r.kernel.org>, "Williams, Dan J"
 <dan.j.williams@...el.com>, "keyrings@...r.kernel.org"
 <keyrings@...r.kernel.org>, "linux-security-module@...r.kernel.org"
 <linux-security-module@...r.kernel.org>, "nvdimm@...ts.linux.dev"
 <nvdimm@...ts.linux.dev>
Subject: Re: [PATCH] KEYS: encrypted: Add check for strsep

On Wed Jan 24, 2024 at 8:21 PM EET, Verma, Vishal L wrote:
> On Wed, 2023-11-08 at 07:36 +0000, Chen Ni wrote:
> > Add check for strsep() in order to transfer the error.
> > 
> > Fixes: cd3bc044af48 ("KEYS: encrypted: Instantiate key with user-
> > provided decrypted data")
> > Signed-off-by: Chen Ni <nichen@...as.ac.cn>
> > ---
> >  security/keys/encrypted-keys/encrypted.c | 4 ++++
> >  1 file changed, 4 insertions(+)
> > 
> > diff --git a/security/keys/encrypted-keys/encrypted.c
> > b/security/keys/encrypted-keys/encrypted.c
> > index 8af2136069d2..76f55dd13cb8 100644
> > --- a/security/keys/encrypted-keys/encrypted.c
> > +++ b/security/keys/encrypted-keys/encrypted.c
> > @@ -237,6 +237,10 @@ static int datablob_parse(char *datablob, const
> > char **format,
> >  			break;
> >  		}
> >  		*decrypted_data = strsep(&datablob, " \t");
> > +		if (!*decrypted_data) {
> > +			pr_info("encrypted_key: decrypted_data is
> > missing\n");
> > +			break;
> > +		}
>
> Hello,
>
> This patch seems to break keyring usage in CXL and NVDIMM, with the
> "decrypted_data is missing" error path being hit. Reverting this commit
> fixes the tests. I'm not sure if there are valid scenarios where this is
> expected to be empty?
>
> Here's an strace snippet of where the error occurs:
>
>    keyctl(KEYCTL_SEARCH, KEY_SPEC_USER_KEYRING, "user", "nvdimm-master", 0) = 76300785
>    openat(AT_FDCWD, "/sys/devices/platform/cxl_acpi.0/root0/nvdimm-bridge0/ndbus0/nmem0/state", O_RDONLY|O_CLOEXEC) = 3
>    read(3, "idle\n", 1024)                 = 5
>    close(3)                                = 0
>    keyctl(KEYCTL_SEARCH, KEY_SPEC_USER_KEYRING, "encrypted", "nvdimm:0", 0) = -1 ENOKEY (Required key not available)
>    uname({sysname="Linux", nodename="fedora", ...}) = 0
>    newfstatat(AT_FDCWD, "/etc/ndctl/keys/nvdimm_0_fedora.blob", 0x7fff23fbc210, 0) = -1 ENOENT (No such file or directory)
>    add_key("encrypted", "nvdimm:0", "new enc32 user:nvdimm-master 32", 31, KEY_SPEC_USER_KEYRING) = -1 EINVAL (Invalid argument)
>    

I think removing the klog message does not make sense meaning
that the recent revert was wrong action taken.

Instead necessary actions to retain backwards compatibility
must be taken, meaning that the branch should set "ret = 0;".

Motivation to keep it is dead obvious: your examples show that
it can reveal potentially incorrect behaviour in user space
software packages. It is info-level to mark that it can be
also false positive. I.e. the revert commit takes away
functionality that previously caused kernel masking a
potential bug.

Please revert the revert.

BR, Jarkko