rpms/kernel/F-10 keys-handle-no-fallback-keyring.patch, NONE, 1.1 kernel.spec, 1.1374, 1.1375

[Chuck Ebbert]

Author: cebbert

Update of /cvs/pkgs/rpms/kernel/F-10
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv15309

Modified Files:
	kernel.spec 
Added Files:
	keys-handle-no-fallback-keyring.patch 
Log Message:
Fix oops in keyring code (F11#501588)

keys-handle-no-fallback-keyring.patch:

--- NEW FILE keys-handle-no-fallback-keyring.patch ---
From: David Howells <dhowells at redhat.com>
Date: Thu, 9 Apr 2009 16:14:05 +0000 (+0100)
Subject: keys: Handle there being no fallback destination keyring for request_key()
X-Git-Tag: v2.6.30-rc2~97
X-Git-Url: http://git.kernel.org/?p=linux%2Fkernel%2Fgit%2Ftorvalds%2Flinux-2.6.git;a=commitdiff_plain;h=34574dd10b6d0697b86703388d6d6af9cbf4bb48

keys: Handle there being no fallback destination keyring for request_key()

When request_key() is called, without there being any standard process
keyrings on which to fall back if a destination keyring is not specified, an
oops is liable to occur when construct_alloc_key() calls down_write() on
dest_keyring's semaphore.

Due to function inlining this may be seen as an oops in down_write() as called
from request_key_and_link().

This situation crops up during boot, where request_key() is called from within
the kernel (such as in CIFS mounts) where nobody is actually logged in, and so
PAM has not had a chance to create a session keyring and user keyrings to act
as the fallback.

To fix this, make construct_alloc_key() not attempt to cache a key if there is
no fallback key if no destination keyring is given specifically.

Signed-off-by: David Howells <dhowells at redhat.com>
Tested-by: Jeff Layton <jlayton at redhat.com>
Signed-off-by: Linus Torvalds <torvalds at linux-foundation.org>
---

diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 22a3158..03fe63e 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -311,7 +311,8 @@ static int construct_alloc_key(struct key_type *type,
 
 	set_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags);
 
-	down_write(&dest_keyring->sem);
+	if (dest_keyring)
+		down_write(&dest_keyring->sem);
 
 	/* attach the key to the destination keyring under lock, but we do need
 	 * to do another check just in case someone beat us to it whilst we
@@ -322,10 +323,12 @@ static int construct_alloc_key(struct key_type *type,
 	if (!IS_ERR(key_ref))
 		goto key_already_present;
 
-	__key_link(dest_keyring, key);
+	if (dest_keyring)
+		__key_link(dest_keyring, key);
 
 	mutex_unlock(&key_construction_mutex);
-	up_write(&dest_keyring->sem);
+	if (dest_keyring)
+		up_write(&dest_keyring->sem);
 	mutex_unlock(&user->cons_lock);
 	*_key = key;
 	kleave(" = 0 [%d]", key_serial(key));


Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/F-10/kernel.spec,v
retrieving revision 1.1374
retrieving revision 1.1375
diff -u -p -r1.1374 -r1.1375
--- kernel.spec	25 May 2009 18:58:37 -0000	1.1374
+++ kernel.spec	25 May 2009 19:06:16 -0000	1.1375
@@ -748,6 +748,9 @@ Patch9502: linux-2.6-x86-hpet-fix-period
 # fix some broken bluetooth dongles
 Patch9600: linux-2.6-bluetooth-submit-bulk-urbs-with-interrupt-urbs.patch
 
+# fix keyring oops (f11#501588)
+Patch9700: keys-handle-no-fallback-keyring.patch
+
 # Backport of upstream memory reduction for ftrace
 Patch10000: linux-2.6-ftrace-memory-reduction.patch
 
@@ -1399,6 +1402,9 @@ ApplyPatch linux-2.6-x86-hpet-fix-period
 
 ApplyPatch linux-2.6-bluetooth-submit-bulk-urbs-with-interrupt-urbs.patch
 
+# fix oops in keyring code
+ApplyPatch keys-handle-no-fallback-keyring.patch
+
 # Reduce the memory usage of ftrace if you don't use it.
 ApplyPatch linux-2.6-ftrace-memory-reduction.patch
 
@@ -1978,6 +1984,9 @@ fi
 %kernel_variant_files -k vmlinux %{with_kdump} kdump
 
 %changelog
+* Mon May 25 2009 Chuck Ebbert <cebbert at redhat.com> 2.6.29.4-75
+- Fix oops in keyring code (F11#501588)
+
 * Mon May 25 2009 Chuck Ebbert <cebbert at redhat.com> 2.6.29.4-74
 - Copy Xen / KVM updates from Fedora 11 kernel:
     kvm-Fix-PDPTR-reloading-on-CR4-writes.patch