[lkml]   [2011]   [Mar]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH] [258/275] Patch cab9e9848b9a8283b0504a2d7c435a9f5ba026de to the 2.6.35.y stable tree
2.6.35-longterm review patch.  If anyone has any objections, please let me know.

stored a ref to the current cred struct in struct scm_cookie. This was fine
with AF_UNIX as that calls scm_destroy() from its packet sending functions, but
AF_NETLINK, which also uses scm_send(), does not call scm_destroy() - meaning
that the copied credentials leak each time SCM data is sent over a netlink

This can be triggered quite simply on a Fedora 13 or 14 userspace with the kernel (or something based off of that) by calling:

for ((i=0; i<100; i++))
su - -c /bin/true
cut -d: -f1 /proc/slabinfo | grep 'cred\|key\|task_struct'
cat /proc/keys | wc -l

This leaks the session key that pam_keyinit creates for 'su -', which appears
in /proc/keys as being revoked (has the R flag set against it) afterward su is

Furthermore, if CONFIG_SLAB=y, then the cred and key slab object usage counts
can be viewed and seen to increase. The key slab increases by one object per
loop, and this can be seen after the system has had a couple of minutes to
stand after the script above has been run on it.

If the system is working correctly, the key and cred counts should return to
roughly what they were before.

This patch from upstream (b47030c71dfd6c8cd5cb6e551b6f7f7cfc96f6a6) is needed
to fix the problem:


From: Eric W. Biederman <>

af_netlink: Add needed scm_destroy after scm_send.

scm_send occasionally allocates state in the scm_cookie, so I have
modified netlink_sendmsg to guarantee that when scm_send succeeds
scm_destory will be called to free that state.

Signed-off-by: Eric W. Biederman <>
Signed-off-by: Andi Kleen <>
Reviewed-by: Daniel Lezcano <>
Acked-by: Pavel Emelyanov <>
Signed-off-by: David S. Miller <>

net/netlink/af_netlink.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)

Index: linux-2.6.35.y/net/netlink/af_netlink.c
--- linux-2.6.35.y.orig/net/netlink/af_netlink.c 2011-03-29 23:57:49.891120088 -0700
+++ linux-2.6.35.y/net/netlink/af_netlink.c 2011-03-30 00:25:02.306350666 -0700
@@ -1323,8 +1323,11 @@
if (msg->msg_flags&MSG_OOB)

- if (NULL == siocb->scm)
+ if (NULL == siocb->scm) {
siocb->scm = &scm;
+ memset(&scm, 0, sizeof(scm));
+ }
err = scm_send(sock, msg, siocb->scm);
if (err < 0)
return err;

 \ /
  Last update: 2011-03-30 23:19    [W:1.712 / U:1.224 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site