1
0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git synced 2026-01-13 01:53:59 +00:00
David Howells 75845c6c1a keys: Fix UAF in key_put()
Once a key's reference count has been reduced to 0, the garbage collector
thread may destroy it at any time and so key_put() is not allowed to touch
the key after that point.  The most key_put() is normally allowed to do is
to touch key_gc_work as that's a static global variable.

However, in an effort to speed up the reclamation of quota, this is now
done in key_put() once the key's usage is reduced to 0 - but now the code
is looking at the key after the deadline, which is forbidden.

Fix this by using a flag to indicate that a key can be gc'd now rather than
looking at the key's refcount in the garbage collector.

Fixes: 9578e327b2b4 ("keys: update key quotas in key_put()")
Reported-by: syzbot+6105ffc1ded71d194d6d@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/673b6aec.050a0220.87769.004a.GAE@google.com/
Signed-off-by: David Howells <dhowells@redhat.com>
Tested-by: syzbot+6105ffc1ded71d194d6d@syzkaller.appspotmail.com
Reviewed-by: Oleg Nesterov <oleg@redhat.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
2025-03-22 15:36:49 +02:00
..
2025-01-24 14:56:59 -08:00
2025-01-22 09:03:41 -08:00
2025-01-29 14:38:19 -08:00
2025-01-23 08:04:07 -08:00
2025-01-27 08:50:19 -08:00
2025-01-18 12:33:39 -08:00
2025-02-01 15:07:56 -08:00
2025-01-25 20:22:31 -08:00
2025-01-09 10:06:14 +01:00
2025-01-25 08:22:26 +00:00
2025-03-22 15:36:49 +02:00
2025-01-14 19:45:35 +01:00
2025-02-04 11:27:45 -05:00
2025-03-19 07:31:43 -07:00
2025-01-21 20:09:14 -08:00
2025-01-20 09:40:49 -08:00
2025-01-15 15:07:23 -08:00
2025-02-25 15:07:24 -05:00
2025-01-25 20:22:42 -08:00
2025-02-10 09:22:32 +01:00
2025-01-25 16:03:40 -08:00
2025-01-16 17:22:59 -08:00
2025-01-20 10:29:11 -08:00
2025-01-10 11:59:00 +01:00
2025-03-16 17:40:22 -07:00
2025-01-08 14:50:11 -08:00
2025-01-29 13:32:23 -08:00
2025-01-11 20:39:43 +01:00
2025-01-29 09:04:28 -08:00
2025-02-08 14:12:17 -08:00
2025-01-23 17:51:16 -08:00