[PATCH 4.1 40/43] KEYS: Fix race between key destruction and finding a keyring by name

From	Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Newsgroups	linux.kernel
Subject	[PATCH 4.1 40/43] KEYS: Fix race between key destruction and finding a keyring by name
Date	2016-01-21 00:20 +0100
Message-ID	<qTacH-4ZC-63@gated-at.bofh.it> (permalink)
References	<qTacF-4ZC-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

4.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: David Howells <dhowells@redhat.com>

commit 94c4554ba07adbdde396748ee7ae01e86cf2d8d7 upstream.

There appears to be a race between:

 (1) key_gc_unused_keys() which frees key->security and then calls
     keyring_destroy() to unlink the name from the name list

 (2) find_keyring_by_name() which calls key_permission(), thus accessing
     key->security, on a key before checking to see whether the key usage is 0
     (ie. the key is dead and might be cleaned up).

Fix this by calling ->destroy() before cleaning up the core key data -
including key->security.

Reported-by: Petr Matousek <pmatouse@redhat.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

---
 security/keys/gc.c |    8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -134,6 +134,10 @@ static noinline void key_gc_unused_keys(
 		kdebug("- %u", key->serial);
 		key_check(key);
 
+		/* Throw away the key data */
+		if (key->type->destroy)
+			key->type->destroy(key);
+
 		security_key_free(key);
 
 		/* deal with the user's key tracking and quota */
@@ -148,10 +152,6 @@ static noinline void key_gc_unused_keys(
 		if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
 			atomic_dec(&key->user->nikeys);
 
-		/* now throw away the key memory */
-		if (key->type->destroy)
-			key->type->destroy(key);
-
 		key_user_put(key->user);
 
 		kfree(key->description);

Thread

[PATCH 4.1 00/43] 4.1.16-stable review Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 40/43] KEYS: Fix race between key destruction and finding a keyring by name Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 25/43] sh_eth: fix kernel oops in skb_put() Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 39/43] rhashtable: Fix walker list corruption Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 31/43] net_sched: make qdisc_tree_decrease_qlen() work for non mq Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 37/43] af_unix: Revert lock_interruptible in stream receive code Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 20/43] sctp: also copy sk_tsflags when copying the socket Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:20 +0100
  [PATCH 4.1 11/43] usb: core : hub: Fix BOS NULL pointer kernel panic Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 05/43] usb-storage: Fix scsi-sd failure "Invalid field in cdb" for USB adapter JMicron Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 15/43] atl1c: Improve driver not to do order 4 GFP_ATOMIC allocation Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 10/43] usb: musb: USB_TI_CPPI41_DMA requires dmaengine support Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 04/43] USB: serial: Another Infineon flash loader USB ID Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 01/43] tpm, tpm_tis: fix tpm_tis ACPI detection issue with TPM 2.0 Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 07/43] USB: add quirk for devices with broken LPM Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 12/43] usb: Use the USB_SS_MULT() macro to decode burst multiplier for log message Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 13/43] pppoe: fix memory corruption in padt work structure Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 06/43] USB: cp210x: Remove CP2110 ID from compatibility list Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 17/43] vxlan: fix incorrect RCO bit in VXLAN header Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 14/43] gre6: allow to update all parameters via rtnl Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  [PATCH 4.1 03/43] USB: cdc_acm: Ignore Infineon Flash Loader utility Greg Kroah-Hartman <gregkh@linuxfoundation.org> - 2016-01-21 00:30 +0100
  Re: [PATCH 4.1 00/43] 4.1.16-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2016-01-21 01:00 +0100
  Re: [PATCH 4.1 00/43] 4.1.16-stable review Guenter Roeck <linux@roeck-us.net> - 2016-01-21 13:30 +0100

csiph-web