From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753584AbbJSQMz (ORCPT ); Mon, 19 Oct 2015 12:12:55 -0400 Received: from mx1.redhat.com ([209.132.183.28]:43982 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751287AbbJSQMx (ORCPT ); Mon, 19 Oct 2015 12:12:53 -0400 Subject: [PATCH 0/2] KEYS: Fix crash in GC From: David Howells To: torvalds@linux-foundation.org, jmorris@namei.org Cc: linux-kernel@vger.kernel.org, stable@vger.kernel.org, dhowells@redhat.com, linux-security-module@vger.kernel.org, keyrings@vger.kernel.org, dvyukov@google.com Date: Mon, 19 Oct 2015 17:12:48 +0100 Message-ID: <20151019161248.3215.91824.stgit@warthog.procyon.org.uk> User-Agent: StGit/0.17.1-dirty MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Hi James, Linus, Here are two patches, the first of which at least should go upstream immediately: (1) Prevent a user-triggerable crash in the keyrings destructor when a negatively instantiated keyring is garbage collected. I have also seen this triggered for user type keys. (2) Prevent the user from using requesting that a keyring be created and instantiated through an upcall. Doing so is probably safe since the keyring type ignores the arguments to its instantiation function - but we probably shouldn't let keyrings be created in this manner. I'm okay with patch (2) being deferred to the next merge window if we're only fixing security bugs at this time upstream. The patches can be found here also: http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=keys-fixes David --- David Howells (2): KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring KEYS: Don't permit request_key() to construct a new keyring security/keys/gc.c | 6 ++++-- security/keys/request_key.c | 3 +++ 2 files changed, 7 insertions(+), 2 deletions(-)