Messages in this thread | | | From | David Howells <> | Subject | Re: Oops (request_key_auth_describe) while running cve-2016-7042 from LTP | Date | Fri, 30 Aug 2019 15:13:03 +0100 |
| |
Hillf Danton <hdanton@sina.com> wrote:
> - struct request_key_auth *rka = dereference_key_rcu(key); > + struct request_key_auth *rka; > + > + rcu_read_lock(); > + rka = dereference_key_rcu(key);
This shouldn't help as the caller, proc_keys_show(), is holding the RCU read lock across the call. The end of the function reads:
if (key->type->describe) key->type->describe(key, m); seq_putc(m, '\n');
rcu_read_unlock(); return 0; }
and the documentation says "This method will be called with the RCU read lock held".
I suspect the actual bugfix is this bit:
> + if (!rka) > + goto out;
David
| |