lkml.org 
[lkml]   [2015]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Subject[PATCH 0/2] KEYS: Fix crash in GC
From
Date

Hi James, Linus,

Here are two patches, the first of which at least should go upstream
immediately:

(1) Prevent a user-triggerable crash in the keyrings destructor when a
negatively instantiated keyring is garbage collected. I have also seen
this triggered for user type keys.

(2) Prevent the user from using requesting that a keyring be created and
instantiated through an upcall. Doing so is probably safe since the
keyring type ignores the arguments to its instantiation function - but we
probably shouldn't let keyrings be created in this manner.

I'm okay with patch (2) being deferred to the next merge window if we're only
fixing security bugs at this time upstream.

The patches can be found here also:

http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-fixes

David
---
David Howells (2):
KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring
KEYS: Don't permit request_key() to construct a new keyring


security/keys/gc.c | 6 ++++--
security/keys/request_key.c | 3 +++
2 files changed, 7 insertions(+), 2 deletions(-)



\
 
 \ /
  Last update: 2015-10-19 18:41    [W:0.389 / U:0.320 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site