Attachment 44641 Details for Bug 100506

[patch] mail as attachment

CAN-2005-2098.diff (text/plain), 1.86 KB, created by Ludwig Nussel on 2005-08-03 13:53:58 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Ludwig Nussel

Created: 2005-08-03 13:53:58 UTC

Size: 1.86 KB

patch

obsolete

>---------- Forwarded message ----------
>Date: Wed, 03 Aug 2005 13:19:03 +0100
>From: David Howells <dhowells@redhat.com>
>To: security@kernel.org
>Subject: [Security] CAN-2005-2098 Error during attempt to join key management
>     session can leave semaphore pinned
>
>
>The attached patch prevents an error during the key session joining operation
>from hanging future joins in the D state [CAN-2005-2098].
>
>The problem is that the error handling path for the KEYCTL_JOIN_SESSION_KEYRING
>operation has one error path that doesn't release the session management
>semaphore. Further attempts to get the semaphore will then sleep for ever in
>the D state.
>
>This can happen in four situations, all involving an attempt to allocate a new
>session keyring:
>
>  (1) ENOMEM.
>
>  (2) The users key quota being reached.
>
>  (3) A keyring name that is an empty string.
>
>  (4) A keyring name that is too long.
>
>Any user may attempt this operation, and so any user can cause the problem to
>occur.
>
>Signed-Off-By: David Howells <dhowells@redhat.com>
>---
>warthog>diffstat -p1 /tmp/linux-2.6.13-key-session-error.patch
>  security/keys/process_keys.c |    2 +-
>  1 files changed, 1 insertion(+), 1 deletion(-)
>
>--- linux-2.6.9/security/keys/process_keys.c.orig	2005-08-02 21:37:05.000000000 +0100
>+++ linux-2.6.9/security/keys/process_keys.c	2005-08-02 21:37:07.000000000 +0100
>@@ -678,7 +678,7 @@ long join_session_keyring(const char *na
>  		keyring = keyring_alloc(name, tsk->uid, tsk->gid, 0, NULL);
>  		if (IS_ERR(keyring)) {
>  			ret = PTR_ERR(keyring);
>-			goto error;
>+			goto error2;
>  		}
>  	}
>  	else if (IS_ERR(keyring)) {
>
>_______________________________________________
>Security mailing list
>Security@linux.kernel.org
>http://linux.kernel.org/mailman/listinfo/security
>_______________________________________________
>Vendor Security mailing list
>Vendor Security@lst.de
>https://www.lst.de/cgi-bin/mailman/listinfo/vendor-sec

Actions: View | Diff

Attachments on bug 100506: 44641