Commit fcea5418 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'keys-next-6.14-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd 

Pull keys fix from Jarkko Sakkinen:
 "Fix potential use-after-free in key_put()"

* tag 'keys-next-6.14-rc8' of git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd:
  keys: Fix UAF in key_put()
parents bb18645a 75845c6c

include/linux/key.h

+1 −0
Original line number Diff line number Diff line
@@ -236,6 +236,7 @@ struct key { 
#define KEY_FLAG_ROOT_CAN_INVAL	7	/* set if key can be invalidated by root without permission */

#define KEY_FLAG_KEEP		8	/* set if key should not be removed */

#define KEY_FLAG_UID_KEYRING	9	/* set if key is a user or user session keyring */

#define KEY_FLAG_FINAL_PUT	10	/* set if final put has happened on key */



	/* the key type and key description string

	 * - the desc is used to match a key against search criteria

security/keys/gc.c

+3 −1
Original line number Diff line number Diff line
@@ -218,8 +218,10 @@ static void key_garbage_collector(struct work_struct *work) 
		key = rb_entry(cursor, struct key, serial_node);

		cursor = rb_next(cursor);



		if (refcount_read(&key->usage) == 0)

		if (test_bit(KEY_FLAG_FINAL_PUT, &key->flags)) {

			smp_mb(); /* Clobber key->user after FINAL_PUT seen. */

			goto found_unreferenced_key;

		}



		if (unlikely(gc_state & KEY_GC_REAPING_DEAD_1)) {

			if (key->type == key_gc_dead_keytype) {

security/keys/key.c

+2 −0
Original line number Diff line number Diff line
@@ -658,6 +658,8 @@ void key_put(struct key *key) 
				key->user->qnbytes -= key->quotalen;

				spin_unlock_irqrestore(&key->user->lock, flags);

			}

			smp_mb(); /* key->user before FINAL_PUT set. */

			set_bit(KEY_FLAG_FINAL_PUT, &key->flags);

			schedule_work(&key_gc_work);

		}

	}