From a4b71a2ac3bfac58dbc6d411abdb414d32dd2efe Mon Sep 17 00:00:00 2001 From: Salvatore Bonaccorso Date: Mon, 19 Oct 2015 21:31:55 +0200 Subject: [PATCH] KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring --- debian/changelog | 1 + ...hen-attempt-to-garbage-collect-an-un.patch | 77 +++++++++++++++++++ debian/patches/series | 1 + 3 files changed, 79 insertions(+) create mode 100644 debian/patches/bugfix/all/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch diff --git a/debian/changelog b/debian/changelog index 689cc9922..1475550b4 100644 --- a/debian/changelog +++ b/debian/changelog @@ -1,6 +1,7 @@ linux (4.2.3-3) UNRELEASED; urgency=medium * KEYS: Fix race between key destruction and finding a keyring by name + * KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring -- Salvatore Bonaccorso Mon, 19 Oct 2015 21:23:18 +0200 diff --git a/debian/patches/bugfix/all/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch b/debian/patches/bugfix/all/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch new file mode 100644 index 000000000..d2850c91a --- /dev/null +++ b/debian/patches/bugfix/all/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch @@ -0,0 +1,77 @@ +From: David Howells +Date: Thu, 15 Oct 2015 17:21:37 +0100 +Subject: KEYS: Fix crash when attempt to garbage collect an uninstantiated keyring +Origin: http://pkgs.fedoraproject.org/cgit/kernel.git/plain/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch?id=d76d5fe34b5c151ad83761160998b1075729b541 + + The following sequence of commands: + + i=`keyctl add user a a @s` + keyctl request2 keyring foo bar @t + keyctl unlink $i @s + + tries to invoke an upcall to instantiate a keyring if one doesn't already + exist by that name within the user's keyring set. However, if the upcall + fails, the code sets keyring->type_data.reject_error to -ENOKEY or some + other error code. When the key is garbage collected, the key destroy + function is called unconditionally and keyring_destroy() uses list_empty() + on keyring->type_data.link - which is in a union with reject_error. + Subsequently, the kernel tries to unlink the keyring from the keyring names + list - which oopses like this: + + BUG: unable to handle kernel paging request at 00000000ffffff8a + IP: [] keyring_destroy+0x3d/0x88 + ... + Workqueue: events key_garbage_collector + ... + RIP: 0010:[] keyring_destroy+0x3d/0x88 + RSP: 0018:ffff88003e2f3d30 EFLAGS: 00010203 + RAX: 00000000ffffff82 RBX: ffff88003bf1a900 RCX: 0000000000000000 + RDX: 0000000000000000 RSI: 000000003bfc6901 RDI: ffffffff81a73a40 + RBP: ffff88003e2f3d38 R08: 0000000000000152 R09: 0000000000000000 + R10: ffff88003e2f3c18 R11: 000000000000865b R12: ffff88003bf1a900 + R13: 0000000000000000 R14: ffff88003bf1a908 R15: ffff88003e2f4000 + ... + CR2: 00000000ffffff8a CR3: 000000003e3ec000 CR4: 00000000000006f0 + ... + Call Trace: + [] key_gc_unused_keys.constprop.1+0x5d/0x10f + [] key_garbage_collector+0x1fa/0x351 + [] process_one_work+0x28e/0x547 + [] worker_thread+0x26e/0x361 + [] ? rescuer_thread+0x2a8/0x2a8 + [] kthread+0xf3/0xfb + [] ? kthread_create_on_node+0x1c2/0x1c2 + [] ret_from_fork+0x3f/0x70 + [] ? kthread_create_on_node+0x1c2/0x1c2 + + Note the value in RAX. This is a 32-bit representation of -ENOKEY. + + The solution is to only call ->destroy() if the key was successfully + instantiated. + + Reported-by: Dmitry Vyukov + Signed-off-by: David Howells +--- + security/keys/gc.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/security/keys/gc.c b/security/keys/gc.c +index 39eac1fd5706..addf060399e0 100644 +--- a/security/keys/gc.c ++++ b/security/keys/gc.c +@@ -134,8 +134,10 @@ static noinline void key_gc_unused_keys(struct list_head *keys) + kdebug("- %u", key->serial); + key_check(key); + +- /* Throw away the key data */ +- if (key->type->destroy) ++ /* Throw away the key data if the key is instantiated */ ++ if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) && ++ !test_bit(KEY_FLAG_NEGATIVE, &key->flags) && ++ key->type->destroy) + key->type->destroy(key); + + security_key_free(key); +-- +2.4.3 + diff --git a/debian/patches/series b/debian/patches/series index 46ea6dbff..67f0b4e8b 100644 --- a/debian/patches/series +++ b/debian/patches/series @@ -109,3 +109,4 @@ bugfix/all/nbd-remove-variable-pid.patch bugfix/all/nbd-add-locking-for-tasks.patch bugfix/all/0001-KEYS-Fix-race-between-key-destruction-and-finding-a-.patch +bugfix/all/0001-KEYS-Fix-crash-when-attempt-to-garbage-collect-an-un.patch