kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-18 19:12:56 +00:00
Code Issues Releases Packages Activity
linux/include/keys
History
Shaomin Chen 4982bfabce keys: Pin request_key_auth payload in instantiate paths 
commit fd15b457a8 upstream.

A: request_key()       B: KEYCTL_INSTANTIATE_IOV
================       =========================

create auth key
store rka in auth key
wait for helper
                       get auth key
                       load rka from auth key
                       copy user payload
                       sleep on #PF

helper completed
detach and free rka
destroy auth key
                       wake up
                       use rka->target_key
                       **USE-AFTER-FREE**

Give request_key_auth payloads a refcount.  Take a payload reference while
authkey->sem stabilizes the payload and revocation state.  Hold that
reference across the instantiate and reject paths.  Drop the auth key
owning reference from revoke and destroy.

[jarkko: Replaced the first two paragraphs of text with an actual
 concurrency scenario.]
Cc: stable@vger.kernel.org # v5.10+
Fixes: b5f545c880 ("[PATCH] keys: Permit running process to instantiate keys")
Reported-by: Shaomin Chen <eeesssooo020@gmail.com>
Closes: https://lore.kernel.org/r/20260519144403.436694-1-eeesssooo020@gmail.com
Signed-off-by: Shaomin Chen <eeesssooo020@gmail.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
History 2026-07-04 13:39:39 +02:00
..
asymmetric-parser.h docs: crypto: convert asymmetric-keys.txt to ReST 2020-06-19 14:03:46 -06:00
asymmetric-subtype.h docs: crypto: convert asymmetric-keys.txt to ReST 2020-06-19 14:03:46 -06:00
asymmetric-type.h ima: Support EC keys for signature verification 2021-03-26 19:41:59 +11:00
big_key-type.h keys: Implement update for the big_key type 2020-06-02 17:22:31 +01:00
ceph-type.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
dns_resolver-type.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
encrypted-type.h encrypted-keys: Replace HTTP links with HTTPS ones 2021-01-21 16:16:09 +00:00
keyring-type.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
request_key_auth-type.h keys: Pin request_key_auth payload in instantiate paths 2026-07-04 13:39:39 +02:00
rxrpc-type.h rxrpc: Don't leak the service-side session key to userspace 2020-11-23 18:09:29 +00:00
system_keyring.h integrity-v5.13 2021-05-01 15:32:18 -07:00
trusted-type.h KEYS: trusted: allow use of kernel RNG for key material 2023-10-19 23:05:33 +02:00
trusted_tee.h KEYS: trusted: Introduce TEE based Trusted Keys 2021-04-14 16:30:30 +03:00
trusted_tpm.h KEYS: trusted: Add generic trusted keys framework 2021-04-14 16:30:30 +03:00
user-type.h KEYS: Replace zero-length array with flexible-array 2020-06-02 17:22:31 +01:00