Commit b1d7dd80 authored Jun 21, 2011 by David Howells Committed by Linus Torvalds Jun 21, 2011

KEYS: Fix error handling in construct_key_and_link()



Fix error handling in construct_key_and_link().

If construct_alloc_key() returns an error, it shouldn't pass out through
the normal path as the key_serial() called by the kleave() statement
will oops when it gets an error code in the pointer:

  BUG: unable to handle kernel paging request at ffffffffffffff84
  IP: [<ffffffff8120b401>] request_key_and_link+0x4d7/0x52f
  ..
  Call Trace:
   [<ffffffff8120b52c>] request_key+0x41/0x75
   [<ffffffffa00ed6e8>] cifs_get_spnego_key+0x206/0x226 [cifs]
   [<ffffffffa00eb0c9>] CIFS_SessSetup+0x511/0x1234 [cifs]
   [<ffffffffa00d9799>] cifs_setup_session+0x90/0x1ae [cifs]
   [<ffffffffa00d9c02>] cifs_get_smb_ses+0x34b/0x40f [cifs]
   [<ffffffffa00d9e05>] cifs_mount+0x13f/0x504 [cifs]
   [<ffffffffa00caabb>] cifs_do_mount+0xc4/0x672 [cifs]
   [<ffffffff8113ae8c>] mount_fs+0x69/0x155
   [<ffffffff8114ff0e>] vfs_kern_mount+0x63/0xa0
   [<ffffffff81150be2>] do_kern_mount+0x4d/0xdf
   [<ffffffff81152278>] do_mount+0x63c/0x69f
   [<ffffffff8115255c>] sys_mount+0x88/0xc2
   [<ffffffff814fbdc2>] system_call_fastpath+0x16/0x1b

Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

parent 35052cff

security/keys/request_key.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -469,7 +469,7 @@ static struct key construct_key_and_link(struct key_type type,
		} else if (ret == -EINPROGRESS) {
		ret = 0;
		} else {
		key = ERR_PTR(ret);
		goto couldnt_alloc_key;
		}

		key_put(dest_keyring);
		@@ -479,6 +479,7 @@ static struct key construct_key_and_link(struct key_type type,
		construction_failed:
		key_negate_and_link(key, key_negative_timeout, NULL, NULL);
		key_put(key);
		couldnt_alloc_key:
		key_put(dest_keyring);
		kleave(" = %d", ret);
		return ERR_PTR(ret);