Home Home > GIT Browse
diff options
authorDavid Howells <dhowells@redhat.com>2009-04-09 17:14:05 +0100
committerGreg Kroah-Hartman <gregkh@suse.de>2009-06-15 09:40:17 -0700
commitcdd7149543f4b9df682be9dca0f4a4a4f2097519 (patch)
parentfb6fda072d7ef219039cc0b0e8218e5f465ef02e (diff)
keys: Handle there being no fallback destination keyring for request_key()
commit 34574dd10b6d0697b86703388d6d6af9cbf4bb48 upstream. When request_key() is called, without there being any standard process keyrings on which to fall back if a destination keyring is not specified, an oops is liable to occur when construct_alloc_key() calls down_write() on dest_keyring's semaphore. Due to function inlining this may be seen as an oops in down_write() as called from request_key_and_link(). This situation crops up during boot, where request_key() is called from within the kernel (such as in CIFS mounts) where nobody is actually logged in, and so PAM has not had a chance to create a session keyring and user keyrings to act as the fallback. To fix this, make construct_alloc_key() not attempt to cache a key if there is no fallback key if no destination keyring is given specifically. Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Jeff Layton <jlayton@redhat.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Cc: Chuck Ebbert <cebbert@redhat.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
1 files changed, 6 insertions, 3 deletions
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 0e04f72ef2d4..ab70cabafa18 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -311,7 +311,8 @@ static int construct_alloc_key(struct key_type *type,
set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);
- down_write(&dest_keyring->sem);
+ if (dest_keyring)
+ down_write(&dest_keyring->sem);
/* attach the key to the destination keyring under lock, but we do need
* to do another check just in case someone beat us to it whilst we
@@ -322,10 +323,12 @@ static int construct_alloc_key(struct key_type *type,
if (!IS_ERR(key_ref))
goto key_already_present;
- __key_link(dest_keyring, key);
+ if (dest_keyring)
+ __key_link(dest_keyring, key);
- up_write(&dest_keyring->sem);
+ if (dest_keyring)
+ up_write(&dest_keyring->sem);
*_key = key;
kleave(" = 0 [%d]", key_serial(key));