Patch "KEYS: Fix keyring ref leak in join_session_keyring()" has been added to the 3.14-stable tree

This is a note to let you know that I've just added the patch titled

KEYS: Fix keyring ref leak in join_session_keyring()

to the 3.14-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
keys-fix-keyring-ref-leak-in-join_session_keyring.patch
and it can be found in the queue-3.14 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree, please let <[email protected]> know about it.

From: Yevgeny Pats <[email protected]>
Date: Tue, 19 Jan 2016 22:09:04 +0000
Subject: KEYS: Fix keyring ref leak in join_session_keyring()

From: Yevgeny Pats <[email protected]>

commit 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2 upstream.

This fixes CVE-2016-0728.

If a thread is asked to join as a session keyring the keyring that's already set as its session, we leak a keyring reference.

This can be tested with the following program:

	#include <stddef.h>
	#include <stdio.h>
	#include <sys/types.h>
	#include <keyutils.h>

	int main(int argc, const char *argv[])
	{
		int i = 0;
		key_serial_t serial;

		serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
				"leaked-keyring");
		if (serial < 0) {
			perror("keyctl");
			return -1;
		}

		if (keyctl(KEYCTL_SETPERM, serial,
			   KEY_POS_ALL | KEY_USR_ALL) < 0) {
			perror("keyctl");
			return -1;
		}

		for (i = 0; i < 100; i++) {
			serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
					"leaked-keyring");
			if (serial < 0) {
				perror("keyctl");
				return -1;
			}
		}

		return 0;
	}

If, after the program has run, there something like the following line in /proc/keys:

3f3d898f I--Q--- 100 perm 3f3f0000 0 0 keyring leaked-keyring: empty

with a usage count of 100 * the number of times the program has been run, then the kernel is malfunctioning. If leaked-keyring has zero usages or has been garbage collected, then the problem is fixed.

---
 security/keys/process_keys.c |    1 +
 1 file changed, 1 insertion(+)

@@ -793,6 +793,7 @@ long join_session_keyring(const char *na
 		ret = PTR_ERR(keyring);
 		goto error2;
 	} else if (keyring == new->session_keyring) {
+		key_put(keyring);
 		ret = 0;
 		goto error2;
 	}

Patches currently in stable-queue which might be from [email protected] are

queue-3.14/keys-fix-keyring-ref-leak-in-join_session_keyring.patch