[lkml]   [2009]   [Oct]   [15]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[PATCH] KEYS: get_instantiation_keyring() should inc the keyring refcount in all cases
    The destination keyring specified to request_key() and co. is made available to
    the process that instantiates the key (the slave process started by
    /sbin/request-key typically). This is passed in the request_key_auth struct as
    the dest_keyring member.

    keyctl_instantiate_key and keyctl_negate_key() call get_instantiation_keyring()
    to get the keyring to attach the newly constructed key to at the end of
    instantiation. This may be given a specific keyring into which a link will be
    made later, or it may be asked to find the keyring passed to request_key(). In
    the former case, it returns a keyring with the refcount incremented by
    lookup_user_key(); in the latter case, it returns the keyring from the
    request_key_auth struct - and does _not_ increment the refcount.

    The latter case will eventually result in an oops when the keyring prematurely
    runs out of references and gets destroyed. The effect may take some time to
    show up as the key is destroyed lazily.

    To fix this, the keyring returned by get_instantiation_keyring() must always
    have its refcount incremented, no matter where it comes from.

    This can be tested by setting /etc/request-key.conf to:

    #====== ======= =============== =============== ===============================
    create * test:* * |/bin/false %u %g %d %{user:_display}
    negate * * * /bin/keyctl negate %k 10 @u

    and then doing:

    keyctl add user _display aaaaaaaa @u
    while keyctl request2 user test:x test:x @u &&
    keyctl list @u;
    keyctl request2 user test:x test:x @u;
    sleep 31;
    keyctl list @u;

    which will oops eventually. Changing the negate line to have @u rather than
    %S at the end is important as that forces the latter case by passing a special
    keyring ID rather than an actual keyring ID.

    Reported-by: Alexander Zangerl <>
    Signed-off-by: David Howells <>
    Tested-by: Alexander Zangerl <>

    security/keys/keyctl.c | 2 +-
    1 files changed, 1 insertions(+), 1 deletions(-)

    diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
    index 2fb28ef..06ec722 100644
    --- a/security/keys/keyctl.c
    +++ b/security/keys/keyctl.c
    @@ -873,7 +873,7 @@ static long get_instantiation_keyring(key_serial_t ringid,
    /* otherwise specify the destination keyring recorded in the
    * authorisation key (any KEY_SPEC_*_KEYRING) */
    if (ringid >= KEY_SPEC_REQUESTOR_KEYRING) {
    - *_dest_keyring = rka->dest_keyring;
    + *_dest_keyring = key_get(rka->dest_keyring);
    return 0;

     \ /
      Last update: 2009-10-15 11:25    [W:0.022 / U:1.768 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site