• Eric Biggers's avatar
    KEYS: reset parent each time before searching key_user_tree · 8f674565
    Eric Biggers authored
    In key_user_lookup(), if there is no key_user for the given uid, we drop
    key_user_lock, allocate a new key_user, and search the tree again.  But
    we failed to set 'parent' to NULL at the beginning of the second search.
    If the tree were to be empty for the second search, the insertion would
    be done with an invalid 'parent', scribbling over freed memory.
    
    Fortunately this can't actually happen currently because the tree always
    contains at least the root_key_user.  But it still should be fixed to
    make the code more robust.
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    8f674565
key.c 30.2 KB