[lkml]   [2012]   [Apr]   [11]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    Patch in this message
    Subject[ 39/42] cred: copy_process() should clear child->replacement_session_keyring
    3.0-stable review patch.  If anyone has any objections, please let me know.


    From: Oleg Nesterov <>

    commit 79549c6dfda0603dba9a70a53467ce62d9335c33 upstream.

    keyctl_session_to_parent(task) sets ->replacement_session_keyring,
    it should be processed and cleared by key_replace_session_keyring().

    However, this task can fork before it notices TIF_NOTIFY_RESUME and
    the new child gets the bogus ->replacement_session_keyring copied by
    dup_task_struct(). This is obviously wrong and, if nothing else, this
    leads to put_cred(already_freed_cred).

    change copy_creds() to clear this member. If copy_process() fails
    before this point the wrong ->replacement_session_keyring doesn't
    matter, exit_creds() won't be called.

    Signed-off-by: Oleg Nesterov <>
    Acked-by: David Howells <>
    Signed-off-by: Linus Torvalds <>
    Signed-off-by: Greg Kroah-Hartman <>

    kernel/cred.c | 2 ++
    1 file changed, 2 insertions(+)

    --- a/kernel/cred.c
    +++ b/kernel/cred.c
    @@ -385,6 +385,8 @@ int copy_creds(struct task_struct *p, un
    struct cred *new;
    int ret;

    + p->replacement_session_keyring = NULL;
    if (
    #ifdef CONFIG_KEYS
    !p->cred->thread_keyring &&

     \ /
      Last update: 2012-04-12 01:33    [W:0.020 / U:6.296 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site