Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1257411
| From | Kamal Mostafa <kamal@canonical.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.19.y-ckt 03/86] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring |
| Date | 2015-10-27 23:20 +0100 |
| Message-ID | <qokKZ-2rO-7@gated-at.bofh.it> (permalink) |
| References | <qok8i-1XT-9@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
3.19.8-ckt9 -stable review patch. If anyone has any objections, please let me know.
------------------
From: David Howells <dhowells@redhat.com>
commit f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61 upstream.
The following sequence of commands:
i=`keyctl add user a a @s`
keyctl request2 keyring foo bar @t
keyctl unlink $i @s
tries to invoke an upcall to instantiate a keyring if one doesn't already
exist by that name within the user's keyring set. However, if the upcall
fails, the code sets keyring->type_data.reject_error to -ENOKEY or some
other error code. When the key is garbage collected, the key destroy
function is called unconditionally and keyring_destroy() uses list_empty()
on keyring->type_data.link - which is in a union with reject_error.
Subsequently, the kernel tries to unlink the keyring from the keyring names
list - which oopses like this:
BUG: unable to handle kernel paging request at 00000000ffffff8a
IP: [<ffffffff8126e051>] keyring_destroy+0x3d/0x88
...
Workqueue: events key_garbage_collector
...
RIP: 0010:[<ffffffff8126e051>] keyring_destroy+0x3d/0x88
RSP: 0018:ffff88003e2f3d30 EFLAGS: 00010203
RAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40
RBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000
R10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900
R13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000
...
CR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0
...
Call Trace:
[<ffffffff8126c756>] key_gc_unused_keys.constprop.1+0x5d/0x10f
[<ffffffff8126ca71>] key_garbage_collector+0x1fa/0x351
[<ffffffff8105ec9b>] process_one_work+0x28e/0x547
[<ffffffff8105fd17>] worker_thread+0x26e/0x361
[<ffffffff8105faa9>] ? rescuer_thread+0x2a8/0x2a8
[<ffffffff810648ad>] kthread+0xf3/0xfb
[<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2
[<ffffffff815f2ccf>] ret_from_fork+0x3f/0x70
[<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2
Note the value in RAX. This is a 32-bit representation of -ENOKEY.
The solution is to only call ->destroy() if the key was successfully
instantiated.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Kamal Mostafa <kamal@canonical.com>
---
security/keys/gc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 39eac1f..addf060 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -134,8 +134,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
kdebug("- %u", key->serial);
key_check(key);
- /* Throw away the key data */
- if (key->type->destroy)
+ /* Throw away the key data if the key is instantiated */
+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
+ !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
+ key->type->destroy)
key->type->destroy(key);
security_key_free(key);
--
1.9.1
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[3.19.y-ckt stable] Linux 3.19.8-ckt9 stable review Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:40 +0100
[PATCH 3.19.y-ckt 86/86] fib_rules: fix fib rule dumps across multiple skbs Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:40 +0100
[PATCH 3.19.y-ckt 85/86] net/ipv6: Correct PIM6 mrt_lock handling Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:40 +0100
[PATCH 3.19.y-ckt 05/86] spi: spi-pxa2xx: Check status register to determine if SSSR_TINT is disabled Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:40 +0100
[PATCH 3.19.y-ckt 83/86] usbnet: Get EVENT_NO_RUNTIME_PM bit before it is cleared Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
[PATCH 3.19.y-ckt 81/86] netlink, mmap: transform mmap skb into full skb on taps Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
[PATCH 3.19.y-ckt 82/86] nfs: fix pg_test page count calculation Kamal Mostafa <kamal@canonical.com> - 2015-10-27 22:50 +0100
[PATCH 3.19.y-ckt 54/86] irqchip/atmel-aic5: Use per chip mask caches in mask/unmask() Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 69/86] netfilter: nft_compat: skip family comparison in case of NFPROTO_UNSPEC Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 71/86] netfilter: nf_log: wait for rcu grace after logger unregistration Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 55/86] spi: xtensa-xtfpga: fix register endianness Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 80/86] ARM: dts: omap5-uevm.dts: fix i2c5 pinctrl offsets Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 78/86] ASoC: fix broken pxa SoC support Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 60/86] ASoC: pxa: pxa2xx-ac97: fix dma requestor lines Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 61/86] ocfs2/dlm: fix deadlock when dispatch assert master Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 72/86] ARM: OMAP2+: board-generic: Remove stale of_irq macros Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 62/86] drm/i915/bios: handle MIPI Sequence Block v3+ gracefully Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 74/86] ARM: 8425/1: kgdb: Don't try to stop the machine when setting breakpoints Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 66/86] PCI: Use function 0 VPD for identical functions, regular VPD for others Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 79/86] netfilter: nf_log: don't zap all loggers on unregister Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 73/86] vxlan: set needed headroom correctly Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 59/86] x86/nmi/64: Fix a paravirt stack-clobbering bug in the NMI code Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 68/86] perf header: Fixup reading of HEADER_NRCPUS feature Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 58/86] x86/paravirt: Replace the paravirt nop with a bona fide empty function Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 76/86] net/mlx4_en: really allow to change RSS key Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 67/86] spi: spidev: fix possible NULL dereference Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 65/86] PCI: Fix devfn for VPD access through function 0 Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 64/86] [SMB3] Fix sec=krb5 on smb3 mounts Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 75/86] tcp: add proper TS val into RST packets Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 77/86] macvtap: fix TUNSETSNDBUF values > 64k Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 63/86] drm/qxl: only report first monitor as connected if we have no state Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 50/86] usb: xhci: exit early in xhci_setup_device() if we're halted or dying Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 70/86] openvswitch: Zero flows on allocation. Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:00 +0100
[PATCH 3.19.y-ckt 44/86] sched: access local runqueue directly in single_task_running Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 46/86] usb: Use the USB_SS_MULT() macro to get the burst multiplier. Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 53/86] xhci: init command timeout timer earlier to avoid deleting it uninitialized Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 33/86] arm: KVM: Fix incorrect device to IPA mapping Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 39/86] arm64: KVM: Disable virtual timer even if the guest is not using it Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 30/86] powerpc/boot: Specify ABI v2 when building an LE boot wrapper Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 37/86] arm64: errata: add module build workaround for erratum #843419 Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 34/86] x86/platform: Fix Geode LX timekeeping in the generic x86 build Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 35/86] arm/arm64: KVM: vgic: Check for !irqchip_in_kernel() when mapping resources Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 42/86] hp-wmi: limit hotkey enable Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 49/86] usb: xhci: Clear XHCI_STATE_DYING on start Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 45/86] KVM: x86: trap AMD MSRs for the TSeg base and mask Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 36/86] arm64: compat: fix vfp save/restore across signal handlers in big-endian Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 48/86] usb: xhci: lock mutex on xhci_stop Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 41/86] staging: ion: fix corruption of ion_import_dma_buf Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 43/86] zram: fix possible use after free in zcomp_create() Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 32/86] KVM: vmx: fix VPID is 0000H in non-root operation Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 52/86] xhci-mem: Use setup_timer Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 26/86] net: mvneta: fix DMA buffer unmapping in mvneta_rx() Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 15/86] x86/apic: Serialize LVTT and TSC_DEADLINE writes Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 11/86] time: Fix timekeeping_freqadjust()'s incorrect use of abs() instead of abs64() Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 31/86] powerpc/mm: Recompute hash value after a failed update Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 51/86] xhci: change xhci 1.0 only restrictions to support xhci 1.1 Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 38/86] s390/compat: correct uc_sigmask of the compat signal frame Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 47/86] xhci: give command abortion one more chance before killing xhci Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 40/86] arm: KVM: Disable virtual timer even if the guest is not using it Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:10 +0100
[PATCH 3.19.y-ckt 09/86] CIFS: fix type confusion in copy offload ioctl Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 07/86] ARM: 8429/1: disable GCC SRA optimization Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 03/86] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 14/86] KVM: arm64: add workaround for Cortex-A57 erratum #852523 Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 20/86] cxl: Fix unbalanced pci_dev_get in cxl_probe Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 08/86] powerpc/MSI: Fix race condition in tearing down MSI interrupts Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 29/86] ARM: fix Thumb2 signal handling when ARMv6 is enabled Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 17/86] Btrfs: fix read corruption of compressed and shared extents Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 27/86] iser-target: remove command with state ISTATE_REMOVE Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 25/86] kvm: fix zero length mmio searching Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 13/86] drm/vmwgfx: Fix up user_dmabuf refcounting Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
Re: [PATCH 3.19.y-ckt 13/86] drm/vmwgfx: Fix up user_dmabuf refcounting Thomas Hellstrom <thellstrom@vmware.com> - 2015-10-28 08:40 +0100
Re: [PATCH 3.19.y-ckt 13/86] drm/vmwgfx: Fix up user_dmabuf refcounting Kamal Mostafa <kamal@canonical.com> - 2015-10-28 20:20 +0100
Re: [PATCH 3.19.y-ckt 13/86] drm/vmwgfx: Fix up user_dmabuf refcounting Kamal Mostafa <kamal@canonical.com> - 2015-10-28 20:30 +0100
[PATCH 3.19.y-ckt 16/86] ARM: dts: omap3-beagle: make i2c3, ddc and tfp410 gpio work again Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 06/86] spi: Fix documentation of spi_alloc_master() Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 21/86] arm64: head.S: initialise mdcr_el2 in el2_setup Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 28/86] iser-target: Put the reference on commands waiting for unsol data Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 02/86] KEYS: Fix race between key destruction and finding a keyring by name Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 01/86] sctp: donot reset the overall_error_count in SHUTDOWN_RECEIVE state Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 24/86] kvm: fix double free for fast mmio eventfd Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 12/86] USB: option: add ZTE PIDs Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 10/86] hwmon: (nct6775) Swap STEP_UP_TIME and STEP_DOWN_TIME registers for most chips Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:20 +0100
[PATCH 3.19.y-ckt 04/86] KEYS: Don't permit request_key() to construct a new keyring Kamal Mostafa <kamal@canonical.com> - 2015-10-27 23:30 +0100
csiph-web