• Sasha Levin's avatar
    KEYS: close race between key lookup and freeing · dc4a2f40
    Sasha Levin authored
    commit a3a87844 upstream.
    
    When a key is being garbage collected, it's key->user would get put before
    the ->destroy() callback is called, where the key is removed from it's
    respective tracking structures.
    
    This leaves a key hanging in a semi-invalid state which leaves a window open
    for a different task to try an access key->user. An example is
    find_keyring_by_name() which would dereference key->user for a key that is
    in the process of being garbage collected (where key->user was freed but
    ->destroy() wasn't called yet - so it's still present in the linked list).
    
    This would cause either a panic, or corrupt memory.
    
    Fixes CVE-2014-9529.
    Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
    [bwh: Backported to 3.2: adjust indentation]
    Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
    dc4a2f40
gc.c 10.2 KB