7a52021908
commit 1b53cf9815bb4744958d41f3795d5d5a1d365e2d upstream.
Filesystem encryption ostensibly supported revoking a keyring key that
had been used to "unlock" encrypted files, causing those files to become
"locked" again. This was, however, buggy for several reasons, the most
severe of which was that when key revocation happened to be detected for
an inode, its fscrypt_info was immediately freed, even while other
threads could be using it for encryption or decryption concurrently.
This could be exploited to crash the kernel or worse.
This patch fixes the use-after-free by removing the code which detects
the keyring key having been revoked, invalidated, or expired. Instead,
an encrypted inode that is "unlocked" now simply remains unlocked until
it is evicted from memory. Note that this is no worse than the case for
block device-level encryption, e.g. dm-crypt, and it still remains
possible for a privileged user to evict unused pages, inodes, and
dentries by running 'sync; echo 3 > /proc/sys/vm/drop_caches', or by
simply unmounting the filesystem. In fact, one of those actions was
already needed anyway for key revocation to work even somewhat sanely.
This change is not expected to break any applications.
In the future I'd like to implement a real API for fscrypt key
revocation that interacts sanely with ongoing filesystem operations ---
waiting for existing operations to complete and blocking new operations,
and invalidating and sanitizing key material and plaintext from the VFS
caches. But this is a hard problem, and for now this bug must be fixed.
This bug affected almost all versions of ext4, f2fs, and ubifs
encryption, and it was potentially reachable in any kernel configured
with encryption support (CONFIG_EXT4_ENCRYPTION=y,
CONFIG_EXT4_FS_ENCRYPTION=y, CONFIG_F2FS_FS_ENCRYPTION=y, or
CONFIG_UBIFS_FS_ENCRYPTION=y). Note that older kernels did not use the
shared fs/crypto/ code, but due to the potential security implications
of this bug, it may still be worthwhile to backport this fix to them.
Fixes: b7236e21d5 ("ext4 crypto: reorganize how we store keys in the inode")
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>
Acked-by: Michael Halcrow <mhalcrow@google.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
150 lines
3.8 KiB
C
150 lines
3.8 KiB
C
/*
|
|
* linux/fs/f2fs/f2fs_crypto.h
|
|
*
|
|
* Copied from linux/fs/ext4/ext4_crypto.h
|
|
*
|
|
* Copyright (C) 2015, Google, Inc.
|
|
*
|
|
* This contains encryption header content for f2fs
|
|
*
|
|
* Written by Michael Halcrow, 2015.
|
|
* Modified by Jaegeuk Kim, 2015.
|
|
*/
|
|
#ifndef _F2FS_CRYPTO_H
|
|
#define _F2FS_CRYPTO_H
|
|
|
|
#include <linux/fs.h>
|
|
|
|
#define F2FS_KEY_DESCRIPTOR_SIZE 8
|
|
|
|
/* Policy provided via an ioctl on the topmost directory */
|
|
struct f2fs_encryption_policy {
|
|
char version;
|
|
char contents_encryption_mode;
|
|
char filenames_encryption_mode;
|
|
char flags;
|
|
char master_key_descriptor[F2FS_KEY_DESCRIPTOR_SIZE];
|
|
} __attribute__((__packed__));
|
|
|
|
#define F2FS_ENCRYPTION_CONTEXT_FORMAT_V1 1
|
|
#define F2FS_KEY_DERIVATION_NONCE_SIZE 16
|
|
|
|
#define F2FS_POLICY_FLAGS_PAD_4 0x00
|
|
#define F2FS_POLICY_FLAGS_PAD_8 0x01
|
|
#define F2FS_POLICY_FLAGS_PAD_16 0x02
|
|
#define F2FS_POLICY_FLAGS_PAD_32 0x03
|
|
#define F2FS_POLICY_FLAGS_PAD_MASK 0x03
|
|
#define F2FS_POLICY_FLAGS_VALID 0x03
|
|
|
|
/**
|
|
* Encryption context for inode
|
|
*
|
|
* Protector format:
|
|
* 1 byte: Protector format (1 = this version)
|
|
* 1 byte: File contents encryption mode
|
|
* 1 byte: File names encryption mode
|
|
* 1 byte: Flags
|
|
* 8 bytes: Master Key descriptor
|
|
* 16 bytes: Encryption Key derivation nonce
|
|
*/
|
|
struct f2fs_encryption_context {
|
|
char format;
|
|
char contents_encryption_mode;
|
|
char filenames_encryption_mode;
|
|
char flags;
|
|
char master_key_descriptor[F2FS_KEY_DESCRIPTOR_SIZE];
|
|
char nonce[F2FS_KEY_DERIVATION_NONCE_SIZE];
|
|
} __attribute__((__packed__));
|
|
|
|
/* Encryption parameters */
|
|
#define F2FS_XTS_TWEAK_SIZE 16
|
|
#define F2FS_AES_128_ECB_KEY_SIZE 16
|
|
#define F2FS_AES_256_GCM_KEY_SIZE 32
|
|
#define F2FS_AES_256_CBC_KEY_SIZE 32
|
|
#define F2FS_AES_256_CTS_KEY_SIZE 32
|
|
#define F2FS_AES_256_XTS_KEY_SIZE 64
|
|
#define F2FS_MAX_KEY_SIZE 64
|
|
|
|
#define F2FS_KEY_DESC_PREFIX "f2fs:"
|
|
#define F2FS_KEY_DESC_PREFIX_SIZE 5
|
|
|
|
struct f2fs_encryption_key {
|
|
__u32 mode;
|
|
char raw[F2FS_MAX_KEY_SIZE];
|
|
__u32 size;
|
|
} __attribute__((__packed__));
|
|
|
|
struct f2fs_crypt_info {
|
|
char ci_data_mode;
|
|
char ci_filename_mode;
|
|
char ci_flags;
|
|
struct crypto_ablkcipher *ci_ctfm;
|
|
char ci_master_key[F2FS_KEY_DESCRIPTOR_SIZE];
|
|
};
|
|
|
|
#define F2FS_CTX_REQUIRES_FREE_ENCRYPT_FL 0x00000001
|
|
#define F2FS_WRITE_PATH_FL 0x00000002
|
|
|
|
struct f2fs_crypto_ctx {
|
|
union {
|
|
struct {
|
|
struct page *bounce_page; /* Ciphertext page */
|
|
struct page *control_page; /* Original page */
|
|
} w;
|
|
struct {
|
|
struct bio *bio;
|
|
struct work_struct work;
|
|
} r;
|
|
struct list_head free_list; /* Free list */
|
|
};
|
|
char flags; /* Flags */
|
|
};
|
|
|
|
struct f2fs_completion_result {
|
|
struct completion completion;
|
|
int res;
|
|
};
|
|
|
|
#define DECLARE_F2FS_COMPLETION_RESULT(ecr) \
|
|
struct f2fs_completion_result ecr = { \
|
|
COMPLETION_INITIALIZER((ecr).completion), 0 }
|
|
|
|
static inline int f2fs_encryption_key_size(int mode)
|
|
{
|
|
switch (mode) {
|
|
case F2FS_ENCRYPTION_MODE_AES_256_XTS:
|
|
return F2FS_AES_256_XTS_KEY_SIZE;
|
|
case F2FS_ENCRYPTION_MODE_AES_256_GCM:
|
|
return F2FS_AES_256_GCM_KEY_SIZE;
|
|
case F2FS_ENCRYPTION_MODE_AES_256_CBC:
|
|
return F2FS_AES_256_CBC_KEY_SIZE;
|
|
case F2FS_ENCRYPTION_MODE_AES_256_CTS:
|
|
return F2FS_AES_256_CTS_KEY_SIZE;
|
|
default:
|
|
BUG();
|
|
}
|
|
return 0;
|
|
}
|
|
|
|
#define F2FS_FNAME_NUM_SCATTER_ENTRIES 4
|
|
#define F2FS_CRYPTO_BLOCK_SIZE 16
|
|
#define F2FS_FNAME_CRYPTO_DIGEST_SIZE 32
|
|
|
|
/**
|
|
* For encrypted symlinks, the ciphertext length is stored at the beginning
|
|
* of the string in little-endian format.
|
|
*/
|
|
struct f2fs_encrypted_symlink_data {
|
|
__le16 len;
|
|
char encrypted_path[1];
|
|
} __attribute__((__packed__));
|
|
|
|
/**
|
|
* This function is used to calculate the disk space required to
|
|
* store a filename of length l in encrypted symlink format.
|
|
*/
|
|
static inline u32 encrypted_symlink_data_len(u32 l)
|
|
{
|
|
return (l + sizeof(struct f2fs_encrypted_symlink_data) - 1);
|
|
}
|
|
#endif /* _F2FS_CRYPTO_H */
|