Commit 086b2a94 authored by Linus Torvalds's avatar Linus Torvalds

Merge tag 'keys-fixes-20150107' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs

Pull keyrings fixes from David Howells:
 "Two fixes:

   - Fix for the order in which things are done during key garbage
     collection to prevent named keyrings causing a crash
     [CVE-2014-9529].

   - Fix assoc_array to explicitly #include rcupdate.h to prevent
     compilation errors under certain circumstances"

* tag 'keys-fixes-20150107' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-fs:
  assoc_array: Include rcupdate.h for call_rcu() definition
  KEYS: close race between key lookup and freeing
parents b11ecb27 990428b8
...@@ -11,6 +11,7 @@ ...@@ -11,6 +11,7 @@
* 2 of the Licence, or (at your option) any later version. * 2 of the Licence, or (at your option) any later version.
*/ */
//#define DEBUG //#define DEBUG
#include <linux/rcupdate.h>
#include <linux/slab.h> #include <linux/slab.h>
#include <linux/err.h> #include <linux/err.h>
#include <linux/assoc_array_priv.h> #include <linux/assoc_array_priv.h>
......
...@@ -148,12 +148,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys) ...@@ -148,12 +148,12 @@ static noinline void key_gc_unused_keys(struct list_head *keys)
if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
atomic_dec(&key->user->nikeys); atomic_dec(&key->user->nikeys);
key_user_put(key->user);
/* now throw away the key memory */ /* now throw away the key memory */
if (key->type->destroy) if (key->type->destroy)
key->type->destroy(key); key->type->destroy(key);
key_user_put(key->user);
kfree(key->description); kfree(key->description);
#ifdef KEY_DEBUGGING #ifdef KEY_DEBUGGING
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment