• David Howells's avatar
    [PATCH] Destruction of failed keyring oopses · 94efe72f
    David Howells authored
    The attached patch makes sure that a keyring that failed to instantiate
    properly is destroyed without oopsing [CAN-2005-2099].
    
    The problem occurs in three stages:
    
     (1) The key allocator initialises the type-specific data to all zeroes. In
         the case of a keyring, this will become a link in the keyring name list
         when the keyring is instantiated.
    
     (2) If a user (any user) attempts to add a keyring with anything other than
         an empty payload, the keyring instantiation function will fail with an
         error and won't add the keyring to the name list.
    
     (3) The keyring's destructor then sees that the keyring has a description
         (name) and tries to remove the keyring from the name list, which oopses
         because the link pointers are both zero.
    
    This bug permits any user to take down a box trivially.
    Signed-Off-By: default avatarDavid Howells <dhowells@redhat.com>
    Signed-off-by: default avatarAndrew Morton <akpm@osdl.org>
    Signed-off-by: default avatarLinus Torvalds <torvalds@osdl.org>
    94efe72f
keyring.c 23 KB