Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1275337
| From | Jiri Slaby <jslaby@suse.cz> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | [PATCH 3.12 64/72] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring |
| Date | 2015-11-23 14:20 +0100 |
| Message-ID | <qxZcf-2dc-45@gated-at.bofh.it> (permalink) |
| References | <qxZcd-2dc-3@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
From: David Howells <dhowells@redhat.com>
3.12-stable review patch. If anyone has any objections, please let me know.
===============
commit f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61 upstream.
The following sequence of commands:
i=`keyctl add user a a @s`
keyctl request2 keyring foo bar @t
keyctl unlink $i @s
tries to invoke an upcall to instantiate a keyring if one doesn't already
exist by that name within the user's keyring set. However, if the upcall
fails, the code sets keyring->type_data.reject_error to -ENOKEY or some
other error code. When the key is garbage collected, the key destroy
function is called unconditionally and keyring_destroy() uses list_empty()
on keyring->type_data.link - which is in a union with reject_error.
Subsequently, the kernel tries to unlink the keyring from the keyring names
list - which oopses like this:
BUG: unable to handle kernel paging request at 00000000ffffff8a
IP: [<ffffffff8126e051>] keyring_destroy+0x3d/0x88
...
Workqueue: events key_garbage_collector
...
RIP: 0010:[<ffffffff8126e051>] keyring_destroy+0x3d/0x88
RSP: 0018:ffff88003e2f3d30 EFLAGS: 00010203
RAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000
RDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40
RBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000
R10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900
R13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000
...
CR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0
...
Call Trace:
[<ffffffff8126c756>] key_gc_unused_keys.constprop.1+0x5d/0x10f
[<ffffffff8126ca71>] key_garbage_collector+0x1fa/0x351
[<ffffffff8105ec9b>] process_one_work+0x28e/0x547
[<ffffffff8105fd17>] worker_thread+0x26e/0x361
[<ffffffff8105faa9>] ? rescuer_thread+0x2a8/0x2a8
[<ffffffff810648ad>] kthread+0xf3/0xfb
[<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2
[<ffffffff815f2ccf>] ret_from_fork+0x3f/0x70
[<ffffffff810647ba>] ? kthread_create_on_node+0x1c2/0x1c2
Note the value in RAX. This is a 32-bit representation of -ENOKEY.
The solution is to only call ->destroy() if the key was successfully
instantiated.
Reported-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: Dmitry Vyukov <dvyukov@google.com>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
---
security/keys/gc.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 483ebdf9c383..de34c290bd6f 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -187,8 +187,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
kdebug("- %u", key->serial);
key_check(key);
- /* Throw away the key data */
- if (key->type->destroy)
+ /* Throw away the key data if the key is instantiated */
+ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
+ !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
+ key->type->destroy)
key->type->destroy(key);
security_key_free(key);
--
2.6.3
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
Back to linux.kernel | Previous | Next — Previous in thread | Next in thread | Find similar | Unroll thread
[PATCH 3.12 00/72] 3.12.51-stable review Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:10 +0100
[PATCH 3.12 48/72] netfilter: xt_NFQUEUE: fix --queue-bypass regression Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 64/72] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 63/72] KEYS: Fix race between key destruction and finding a keyring by name Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 55/72] net: sun4i-emac: fix memory leak on bad packet Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 54/72] ceph: fix kick_requests() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 50/72] bridge: superfluous skb->nfct check in br_nf_dev_queue_xmit Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 56/72] macmace: add missing platform_set_drvdata() in mace_probe() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 52/72] ceph: make sure request isn't in any waiting list when kicking request. Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 58/72] r8169: disable L23 Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 66/72] KVM: x86: work around infinite loop in microcode when #AC is delivered Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 57/72] r8169: fix the incorrect tx descriptor version Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 51/72] net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland. Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 71/72] x86/mm/hotplug: Pass sync_global_pgds() a correct argument in remove_pagetable() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:20 +0100
[PATCH 3.12 10/72] power: bq24190_charger: suppress build warning Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 15/72] dm btree: fix leak of bufio-backed block in btree_split_beneath error path Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 35/72] irda: precedence bug in irlmp_seq_hb_idx() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 22/72] md/raid10: submit_bio_wait() returns 0 on success Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 37/72] ppp: fix pppoe_dev deletion condition in pppoe_release() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 20/72] crypto: api - Only abort operations on fatal signal Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 27/72] mfd: wm5110: Add register patch for rev D chip Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 21/72] md/raid1: submit_bio_wait() returns 0 on success Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 25/72] serial: 8250_pci: Add support for 16 port Exar boards Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
Re: [PATCH 3.12 25/72] serial: 8250_pci: Add support for 16 port Exar boards Soeren Grunewald <soeren.grunewald@desy.de> - 2015-11-23 15:30 +0100
[PATCH 3.12 32/72] libahci: Allow drivers to override start_engine Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 24/72] IB/cm: Fix rb-tree duplicate free and use-after-free Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 30/72] audit: correctly record file names with different path name types Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 26/72] serial: 8250_pci: Add support for 12 port Exar boards Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 12/72] drm/nouveau/gem: return only valid domain when there's only one Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 39/72] net/mlx4: Copy/set only sizeof struct mlx4_eqe bytes Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 28/72] mfd: wm5110: Add register patch for rev E and above Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 16/72] xhci: handle no ping response error properly Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 18/72] xen-blkfront: check for null drvdata in blkback_changed (XenbusStateClosing) Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 19/72] module: Fix locking in symbol_put_addr() Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 11/72] spi: fix pointer-integer size mismatch warning Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 31/72] audit: create private file name copies when auditing inodes Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 17/72] xhci: Add spurious wakeup quirk for LynxPoint-LP controllers Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 23/72] mvsas: Fix NULL pointer dereference in mvs_slot_task_free Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
[PATCH 3.12 34/72] Fix regression in NFSRDMA server Jiri Slaby <jslaby@suse.cz> - 2015-11-23 14:30 +0100
Re: [PATCH 3.12 34/72] Fix regression in NFSRDMA server Tom Tucker <tom@opengridcomputing.com> - 2015-11-23 16:40 +0100
Re: [PATCH 3.12 00/72] 3.12.51-stable review Guenter Roeck <linux@roeck-us.net> - 2015-11-23 17:30 +0100
Re: [PATCH 3.12 00/72] 3.12.51-stable review Guenter Roeck <linux@roeck-us.net> - 2015-11-23 17:30 +0100
Re: [PATCH 3.12 00/72] 3.12.51-stable review Shuah Khan <shuahkh@osg.samsung.com> - 2015-11-23 17:40 +0100
Re: [PATCH 3.12 00/72] 3.12.51-stable review Guenter Roeck <linux@roeck-us.net> - 2015-11-24 04:50 +0100
Re: [PATCH 3.12 00/72] 3.12.51-stable review Jiri Slaby <jslaby@suse.cz> - 2015-11-30 10:10 +0100
csiph-web