From a117f431179a2747f2b1d5293f43d9e198f1bac9 Mon Sep 17 00:00:00 2001
From: Ondrej Kozina <okozina@redhat.com>
Date: Mon, 30 Nov 2015 16:44:15 +0100
Subject: [PATCH] Fix access to unaligned hidden TrueCrypt header.
backport all changes needed to fix unaligned access
to hidden TrueCrypt hedaer.
---
lib/internal.h | 7 ++-
lib/luks1/keymanage.c | 6 +-
lib/tcrypt/tcrypt.c | 24 ++++----
lib/utils.c | 155 +++++++++++++++++++++++++++++++++++++++++++-------
4 files changed, 152 insertions(+), 40 deletions(-)
diff --git a/lib/internal.h b/lib/internal.h
index 382a600..f1525f2 100644
--- a/lib/internal.h
+++ b/lib/internal.h
@@ -101,9 +101,12 @@ char *crypt_get_partition_device(const char *dev_path, uint64_t offset, uint64_t
char *crypt_get_base_device(const char *dev_path);
uint64_t crypt_dev_partition_offset(const char *dev_path);
+ssize_t write_buffer(int fd, const void *buf, size_t count);
+ssize_t read_buffer(int fd, void *buf, size_t count);
ssize_t write_blockwise(int fd, int bsize, void *buf, size_t count);
-ssize_t read_blockwise(int fd, int bsize, void *_buf, size_t count);
-ssize_t write_lseek_blockwise(int fd, int bsize, char *buf, size_t count, off_t offset);
+ssize_t read_blockwise(int fd, int bsize, void *buf, size_t count);
+ssize_t write_lseek_blockwise(int fd, int bsize, void *buf, size_t count, off_t offset);
+ssize_t read_lseek_blockwise(int fd, int bsize, void *buf, size_t count, off_t offset);
unsigned crypt_getpagesize(void);
int init_crypto(struct crypt_device *ctx);
diff --git a/lib/luks1/keymanage.c b/lib/luks1/keymanage.c
index 23e3fe2..b193ee9 100644
--- a/lib/luks1/keymanage.c
+++ b/lib/luks1/keymanage.c
@@ -201,7 +201,7 @@ int LUKS_hdr_backup(const char *backup_file, struct crypt_device *ctx)
r = -EINVAL;
goto out;
}
- if (write(devfd, buffer, buffer_size) < buffer_size) {
+ if (write_buffer(devfd, buffer, buffer_size) < buffer_size) {
log_err(ctx, _("Cannot write header backup file %s.\n"), backup_file);
r = -EIO;
goto out;
@@ -253,7 +253,7 @@ int LUKS_hdr_restore(
goto out;
}
- if (read(devfd, buffer, buffer_size) < buffer_size) {
+ if (read_buffer(devfd, buffer, buffer_size) < buffer_size) {
log_err(ctx, _("Cannot read header backup file %s.\n"), backup_file);
r = -EIO;
goto out;
@@ -498,7 +498,7 @@ int LUKS_read_phdr_backup(const char *backup_file,
return -ENOENT;
}
- if (read(devfd, hdr, hdr_size) < hdr_size)
+ if (read_buffer(devfd, hdr, hdr_size) < hdr_size)
r = -EIO;
else {
LUKS_fix_header_compatible(hdr);
diff --git a/lib/tcrypt/tcrypt.c b/lib/tcrypt/tcrypt.c
index 45154ed..9ff7157 100644
--- a/lib/tcrypt/tcrypt.c
+++ b/lib/tcrypt/tcrypt.c
@@ -469,8 +469,7 @@ static int TCRYPT_pool_keyfile(struct crypt_device *cd,
return -EIO;
}
- /* FIXME: add while */
- data_size = read(fd, data, TCRYPT_KEYFILE_LEN);
+ data_size = read_buffer(fd, data, TCRYPT_KEYFILE_LEN);
close(fd);
if (data_size < 0) {
log_err(cd, _("Error reading keyfile %s.\n"), keyfile);
@@ -628,27 +627,26 @@ int TCRYPT_read_phdr(struct crypt_device *cd,
r = -EIO;
if (params->flags & CRYPT_TCRYPT_SYSTEM_HEADER) {
- if (lseek(devfd, TCRYPT_HDR_SYSTEM_OFFSET, SEEK_SET) >= 0 &&
- read_blockwise(devfd, bs, hdr, hdr_size) == hdr_size) {
+ if (read_lseek_blockwise(devfd, bs, hdr, hdr_size,
+ TCRYPT_HDR_SYSTEM_OFFSET) == hdr_size) {
r = TCRYPT_init_hdr(cd, hdr, params);
}
} else if (params->flags & CRYPT_TCRYPT_HIDDEN_HEADER) {
if (params->flags & CRYPT_TCRYPT_BACKUP_HEADER) {
- if (lseek(devfd, TCRYPT_HDR_HIDDEN_OFFSET_BCK, SEEK_END) >= 0 &&
- read_blockwise(devfd, bs, hdr, hdr_size) == hdr_size)
+ if (read_lseek_blockwise(devfd, bs, hdr, hdr_size,
+ TCRYPT_HDR_HIDDEN_OFFSET_BCK) == hdr_size)
r = TCRYPT_init_hdr(cd, hdr, params);
} else {
- if (lseek(devfd, TCRYPT_HDR_HIDDEN_OFFSET, SEEK_SET) >= 0 &&
- read_blockwise(devfd, bs, hdr, hdr_size) == hdr_size)
+ if (read_lseek_blockwise(devfd, bs, hdr, hdr_size,
+ TCRYPT_HDR_HIDDEN_OFFSET) == hdr_size)
r = TCRYPT_init_hdr(cd, hdr, params);
- if (r &&
- lseek(devfd, TCRYPT_HDR_HIDDEN_OFFSET_OLD, SEEK_END) >= 0 &&
- read_blockwise(devfd, bs, hdr, hdr_size) == hdr_size)
+ if (r && read_lseek_blockwise(devfd, bs, hdr, hdr_size,
+ TCRYPT_HDR_HIDDEN_OFFSET_OLD) == hdr_size)
r = TCRYPT_init_hdr(cd, hdr, params);
}
} else if (params->flags & CRYPT_TCRYPT_BACKUP_HEADER) {
- if (lseek(devfd, TCRYPT_HDR_OFFSET_BCK, SEEK_END) >= 0 &&
- read_blockwise(devfd, bs, hdr, hdr_size) == hdr_size)
+ if (read_lseek_blockwise(devfd, bs, hdr, hdr_size,
+ TCRYPT_HDR_OFFSET_BCK) == hdr_size)
r = TCRYPT_init_hdr(cd, hdr, params);
} else if (read_blockwise(devfd, bs, hdr, hdr_size) == hdr_size)
r = TCRYPT_init_hdr(cd, hdr, params);
diff --git a/lib/utils.c b/lib/utils.c
index 2dcf753..802ba55 100644
--- a/lib/utils.c
+++ b/lib/utils.c
@@ -56,22 +56,70 @@ static void *aligned_malloc(void **base, int size, int alignment)
/* Credits go to Michal's padlock patches for this alignment code */
char *ptr;
- ptr = malloc(size + alignment);
- if(ptr == NULL) return NULL;
+ ptr = malloc(size + alignment);
+ if (!ptr)
+ return NULL;
*base = ptr;
- if(alignment > 1 && ((long)ptr & (alignment - 1))) {
+ if (alignment > 1 && ((long)ptr & (alignment - 1)))
ptr += alignment - ((long)(ptr) & (alignment - 1));
- }
+
return ptr;
#endif
}
+ssize_t read_buffer(int fd, void *buf, size_t count)
+{
+ size_t read_size = 0;
+ ssize_t r;
+
+ if (fd < 0 || !buf)
+ return -EINVAL;
+
+ do {
+ r = read(fd, buf, count - read_size);
+ if (r == -1 && errno != EINTR)
+ return r;
+ if (r == 0)
+ return (ssize_t)read_size;
+ if (r > 0) {
+ read_size += (size_t)r;
+ buf = (uint8_t*)buf + r;
+ }
+ } while (read_size != count);
+
+ return (ssize_t)count;
+}
+
+ssize_t write_buffer(int fd, const void *buf, size_t count)
+{
+ size_t write_size = 0;
+ ssize_t w;
+
+ if (fd < 0 || !buf || !count)
+ return -EINVAL;
+
+ do {
+ w = write(fd, buf, count - write_size);
+ if (w < 0 && errno != EINTR)
+ return w;
+ if (w == 0)
+ return (ssize_t)write_size;
+ if (w > 0) {
+ write_size += (size_t) w;
+ buf = (const uint8_t*)buf + w;
+ }
+ } while (write_size != count);
+
+ return (ssize_t)write_size;
+}
+
ssize_t write_blockwise(int fd, int bsize, void *orig_buf, size_t count)
{
void *hangover_buf, *hangover_buf_base = NULL;
void *buf, *buf_base = NULL;
- int r, hangover, solid, alignment;
+ int r, alignment;
+ size_t hangover, solid;
ssize_t ret = -1;
if (fd == -1 || !orig_buf || bsize <= 0)
@@ -89,17 +137,19 @@ ssize_t write_blockwise(int fd, int bsize, void *orig_buf, size_t count)
} else
buf = orig_buf;
- r = write(fd, buf, solid);
- if (r < 0 || r != solid)
- goto out;
+ if (solid) {
+ r = write_buffer(fd, buf, solid);
+ if (r < 0 || r != (ssize_t)solid)
+ goto out;
+ }
if (hangover) {
hangover_buf = aligned_malloc(&hangover_buf_base, bsize, alignment);
if (!hangover_buf)
goto out;
- r = read(fd, hangover_buf, bsize);
- if (r < 0 || r < hangover)
+ r = read_buffer(fd, hangover_buf, bsize);
+ if (r < 0 || r < (ssize_t)hangover)
goto out;
if (r < bsize)
@@ -110,8 +160,8 @@ ssize_t write_blockwise(int fd, int bsize, void *orig_buf, size_t count)
memcpy(hangover_buf, (char*)buf + solid, hangover);
- r = write(fd, hangover_buf, bsize);
- if (r < 0 || r < hangover)
+ r = write_buffer(fd, hangover_buf, bsize);
+ if (r < 0 || r < (ssize_t)hangover)
goto out;
}
ret = count;
@@ -122,10 +172,12 @@ out:
return ret;
}
-ssize_t read_blockwise(int fd, int bsize, void *orig_buf, size_t count) {
+ssize_t read_blockwise(int fd, int bsize, void *orig_buf, size_t count)
+{
void *hangover_buf, *hangover_buf_base = NULL;
void *buf, *buf_base = NULL;
- int r, hangover, solid, alignment;
+ int r, alignment;
+ size_t hangover, solid;
ssize_t ret = -1;
if (fd == -1 || !orig_buf || bsize <= 0)
@@ -142,16 +194,16 @@ ssize_t read_blockwise(int fd, int bsize, void *orig_buf, size_t count) {
} else
buf = orig_buf;
- r = read(fd, buf, solid);
- if(r < 0 || r != solid)
+ r = read_buffer(fd, buf, solid);
+ if (r < 0 || r != (ssize_t)solid)
goto out;
if (hangover) {
hangover_buf = aligned_malloc(&hangover_buf_base, bsize, alignment);
if (!hangover_buf)
goto out;
- r = read(fd, hangover_buf, bsize);
- if (r < 0 || r < hangover)
+ r = read_buffer(fd, hangover_buf, bsize);
+ if (r < 0 || r < (ssize_t)hangover)
goto out;
memcpy((char *)buf + solid, hangover_buf, hangover);
@@ -172,7 +224,8 @@ out:
* is implicitly included in the read/write offset, which can not be set to non-aligned
* boundaries. Hence, we combine llseek with write.
*/
-ssize_t write_lseek_blockwise(int fd, int bsize, char *buf, size_t count, off_t offset) {
+ssize_t write_lseek_blockwise(int fd, int bsize, void *buf, size_t count, off_t offset)
+{
char *frontPadBuf;
void *frontPadBuf_base = NULL;
int r, frontHang;
@@ -182,6 +235,12 @@ ssize_t write_lseek_blockwise(int fd, int bsize, char *buf, size_t count, off_t
if (fd == -1 || !buf || bsize <= 0)
return -1;
+ if (offset < 0)
+ offset = lseek(fd, offset, SEEK_END);
+
+ if (offset < 0)
+ return -1;
+
frontHang = offset % bsize;
if (lseek(fd, offset - frontHang, SEEK_SET) < 0)
@@ -193,7 +252,7 @@ ssize_t write_lseek_blockwise(int fd, int bsize, char *buf, size_t count, off_t
if (!frontPadBuf)
goto out;
- r = read(fd, frontPadBuf, bsize);
+ r = read_buffer(fd, frontPadBuf, bsize);
if (r < 0 || r != bsize)
goto out;
@@ -206,11 +265,11 @@ ssize_t write_lseek_blockwise(int fd, int bsize, char *buf, size_t count, off_t
if (lseek(fd, offset - frontHang, SEEK_SET) < 0)
goto out;
- r = write(fd, frontPadBuf, bsize);
+ r = write_buffer(fd, frontPadBuf, bsize);
if (r < 0 || r != bsize)
goto out;
- buf += innerCount;
+ buf = (char*)buf + innerCount;
count -= innerCount;
}
@@ -223,6 +282,58 @@ out:
return ret;
}
+ssize_t read_lseek_blockwise(int fd, int bsize, void *buf, size_t count, off_t offset)
+{
+ char *frontPadBuf;
+ void *frontPadBuf_base = NULL;
+ int r, frontHang;
+ size_t innerCount = 0;
+ ssize_t ret = -1;
+
+ if (fd == -1 || !buf || bsize <= 0)
+ return -1;
+
+ if (offset < 0)
+ offset = lseek(fd, offset, SEEK_END);
+
+ if (offset < 0)
+ return -1;
+
+ frontHang = offset % bsize;
+
+ if (lseek(fd, offset - frontHang, SEEK_SET) < 0)
+ return ret;
+
+ if (frontHang) {
+ frontPadBuf = aligned_malloc(&frontPadBuf_base,
+ bsize, get_alignment(fd));
+
+ if (!frontPadBuf)
+ return ret;
+
+ r = read_buffer(fd, frontPadBuf, bsize);
+ if (r < 0 || r != bsize)
+ goto out;
+
+ innerCount = bsize - frontHang;
+ if (innerCount > count)
+ innerCount = count;
+
+ memcpy(buf, frontPadBuf + frontHang, innerCount);
+
+ buf = (char*)buf + innerCount;
+ count -= innerCount;
+ }
+
+ ret = read_blockwise(fd, bsize, buf, count);
+ if (ret >= 0)
+ ret += innerCount;
+out:
+ free(frontPadBuf_base);
+
+ return ret;
+}
+
/* MEMLOCK */
#define DEFAULT_PROCESS_PRIORITY -18
--
2.7.4