Skip to content

Fix issues with possible security implications (Part 1) #11

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
NewEraCracker wants to merge 4 commits into from
Closed

Fix issues with possible security implications (Part 1) #11

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
dcd87e0
KEYS: Fix race between read and revoke
dhowells Dec 18, 2015
4e5ac21
KEYS: potential uninitialized variable
Jun 16, 2016
53ac861
KEYS: Fix short sprintf buffer in /proc/keys show function
dhowells Sep 6, 2016
a1448d8
BACKPORT: security: fix typo in security_task_prctl
thejh Sep 18, 2015
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion include/linux/security.h
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2527,7 +2527,7 @@ static inline int security_task_prctl(int option, unsigned long arg2,
unsigned long arg4,
unsigned long arg5)
{
return cap_task_prctl(option, arg2, arg3, arg3, arg5);
return cap_task_prctl(option, arg2, arg3, arg4, arg5);
}

static inline void security_task_to_inode(struct task_struct *p, struct inode *inode)
Expand Down
2 changes: 1 addition & 1 deletion security/keys/key.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -580,7 +580,7 @@ int key_reject_and_link(struct key *key,

mutex_unlock(&key_construction_mutex);

if (keyring)
if (keyring && link_ret == 0)
__key_link_end(keyring, &key->index_key, edit);

/* wake up anyone waiting for a key to be constructed */
Expand Down
18 changes: 9 additions & 9 deletions security/keys/keyctl.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -757,16 +757,16 @@ long keyctl_read_key(key_serial_t keyid, char __user *buffer, size_t buflen)

/* the key is probably readable - now try to read it */
can_read_key:
ret = key_validate(key);
if (ret == 0) {
ret = -EOPNOTSUPP;
if (key->type->read) {
/* read the data with the semaphore held (since we
* might sleep) */
down_read(&key->sem);
ret = -EOPNOTSUPP;
if (key->type->read) {
/* Read the data with the semaphore held (since we might sleep)
* to protect against the key being updated or revoked.
*/
down_read(&key->sem);
ret = key_validate(key);
if (ret == 0)
ret = key->type->read(key, buffer, buflen);
up_read(&key->sem);
}
up_read(&key->sem);
}

error2:
Expand Down
2 changes: 1 addition & 1 deletion security/keys/proc.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -187,7 +187,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
struct timespec now;
unsigned long timo;
key_ref_t key_ref, skey_ref;
char xbuf[12];
char xbuf[16];
int rc;

struct keyring_search_context ctx = {
Expand Down