KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
Subsystems (3)
PATCH v2 1/1 KEYS: fix keyctl_set_reqkey_keyring() to not leak thread keyrings
From: Eric Biggers <[email protected]>
Running the following program as an unprivileged user exhausts kernel memory by leaking thread keyrings:
#include <keyutils.h>
int main()
{
for (;;)
keyctl_set_reqkey_keyring(KEY_REQKEY_DEFL_THREAD_KEYRING);
}Fix it by only creating a new thread keyring if there wasn't one before. To make things more consistent, make install_thread_keyring_to_cred() and install_process_keyring_to_cred() both return 0 if the corresponding keyring is already present.
Fixes d84f4f992cbd ("CRED: Inaugurate COW credentials")
Cc stable at vger.kernel.org # 2.6.29+
Signed-off-by Eric Biggers <[email protected]>
--- security/keys/keyctl.c | 11 ++++------- security/keys/process_keys.c | 44 +++++++++++++++++++++++++++----------------- 2 files changed, 31 insertions(+), 24 deletions(-)
security/keys/keyctl.c +4 -7
@@ -1253,8 +1253,8 @@ long keyctl_reject_key(key_serial_t id, unsigned timeout, unsigned error,* Read or set the default keyring in which request_key() will cache keys and * return the old setting. * -* If a process keyring is specified then this will be created if it doesn't -* yet exist. The old setting will be returned if successful. +* If a thread or process keyring is specified then it will be created if it +* doesn't yet exist. The old setting will be returned if successful. */ long keyctl_set_reqkey_keyring (int reqkey_defl) {
@@ -1279,11 +1279,8 @@ long keyctl_set_reqkey_keyring(int reqkey_defl)case KEY_REQKEY_DEFL_PROCESS_KEYRING : ret =install_process_keyring_to_cred (new); -if (ret <0 ) { -if (ret != -EEXIST ) - goto error; - ret =0 ; - } +if (ret <0 ) + goto error; goto set;case KEY_REQKEY_DEFL_DEFAULT :
security/keys/process_keys.c +27 -17
105 lines not on this page · raw message
Signature · 6 lines
2.12.2.715.g7642488e1d-goog -- To unsubscribe from this list: send the line "unsubscribe linux-security-module" in the body of a message to majordomo at vger.kernel.org More majordomo info@ http://vger.kernel.org/majordomo-info.html