Linux v4.2-rc4-53-g956325bd55bb
This commit is contained in:
parent
7031fc6322
commit
b6e2727857
@ -1,45 +0,0 @@
|
|||||||
From 3881b164810a564714dfdc16520b0fe538ae4bf7 Mon Sep 17 00:00:00 2001
|
|
||||||
From: David Howells <dhowells@redhat.com>
|
|
||||||
Date: Mon, 27 Jul 2015 15:23:43 +0100
|
|
||||||
Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid
|
|
||||||
|
|
||||||
__key_link_end is not freeing the associated array edit structure
|
|
||||||
and this leads to a 512 byte memory leak each time an identical
|
|
||||||
existing key is added with add_key().
|
|
||||||
|
|
||||||
The reason the add_key() system call returns okay is that
|
|
||||||
key_create_or_update() calls __key_link_begin() before checking to see
|
|
||||||
whether it can update a key directly rather than adding/replacing - which
|
|
||||||
it turns out it can. Thus __key_link() is not called through
|
|
||||||
__key_instantiate_and_link() and __key_link_end() must cancel the edit.
|
|
||||||
|
|
||||||
CVE-2015-1333
|
|
||||||
|
|
||||||
Signed-off-by: Colin Ian King <colin.king@canonical.com>
|
|
||||||
Signed-off-by: David Howells <dhowells@redhat.com>
|
|
||||||
---
|
|
||||||
security/keys/keyring.c | 8 +++++---
|
|
||||||
1 file changed, 5 insertions(+), 3 deletions(-)
|
|
||||||
|
|
||||||
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
|
|
||||||
index e72548b5897e..d33437007ad2 100644
|
|
||||||
--- a/security/keys/keyring.c
|
|
||||||
+++ b/security/keys/keyring.c
|
|
||||||
@@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring,
|
|
||||||
if (index_key->type == &key_type_keyring)
|
|
||||||
up_write(&keyring_serialise_link_sem);
|
|
||||||
|
|
||||||
- if (edit && !edit->dead_leaf) {
|
|
||||||
- key_payload_reserve(keyring,
|
|
||||||
- keyring->datalen - KEYQUOTA_LINK_BYTES);
|
|
||||||
+ if (edit) {
|
|
||||||
+ if (!edit->dead_leaf) {
|
|
||||||
+ key_payload_reserve(keyring,
|
|
||||||
+ keyring->datalen - KEYQUOTA_LINK_BYTES);
|
|
||||||
+ }
|
|
||||||
assoc_array_cancel_edit(edit);
|
|
||||||
}
|
|
||||||
up_write(&keyring->sem);
|
|
||||||
--
|
|
||||||
2.4.3
|
|
||||||
|
|
@ -67,7 +67,7 @@ Summary: The Linux kernel
|
|||||||
# The rc snapshot level
|
# The rc snapshot level
|
||||||
%define rcrev 4
|
%define rcrev 4
|
||||||
# The git snapshot level
|
# The git snapshot level
|
||||||
%define gitrev 1
|
%define gitrev 2
|
||||||
# Set rpm version accordingly
|
# Set rpm version accordingly
|
||||||
%define rpmversion 4.%{upstream_sublevel}.0
|
%define rpmversion 4.%{upstream_sublevel}.0
|
||||||
%endif
|
%endif
|
||||||
@ -582,8 +582,6 @@ Patch502: firmware-Drop-WARN-from-usermodehelper_read_trylock-.patch
|
|||||||
|
|
||||||
Patch503: drm-i915-turn-off-wc-mmaps.patch
|
Patch503: drm-i915-turn-off-wc-mmaps.patch
|
||||||
|
|
||||||
Patch504: KEYS-ensure-we-free-the-assoc-array-edit-if-edit-is-.patch
|
|
||||||
|
|
||||||
Patch904: kdbus.patch
|
Patch904: kdbus.patch
|
||||||
|
|
||||||
# END OF PATCH DEFINITIONS
|
# END OF PATCH DEFINITIONS
|
||||||
@ -2021,6 +2019,9 @@ fi
|
|||||||
#
|
#
|
||||||
#
|
#
|
||||||
%changelog
|
%changelog
|
||||||
|
* Wed Jul 29 2015 Josh Boyer <jwboyer@fedoraproject.org> - 4.2.0-0.rc4.git2.1
|
||||||
|
- Linux v4.2-rc4-53-g956325bd55bb
|
||||||
|
|
||||||
* Wed Jul 29 2015 Josh Boyer <jwboyer@fedoraproject.org>
|
* Wed Jul 29 2015 Josh Boyer <jwboyer@fedoraproject.org>
|
||||||
- Drop acpi_brightness_enable revert patch
|
- Drop acpi_brightness_enable revert patch
|
||||||
|
|
||||||
|
2
sources
2
sources
@ -1,4 +1,4 @@
|
|||||||
fe9dc0f6729f36400ea81aa41d614c37 linux-4.1.tar.xz
|
fe9dc0f6729f36400ea81aa41d614c37 linux-4.1.tar.xz
|
||||||
84e34c2f58901edcc5c840fe9893c02e perf-man-4.1.tar.gz
|
84e34c2f58901edcc5c840fe9893c02e perf-man-4.1.tar.gz
|
||||||
8c9a9889e1994c220e9794ffc54301f2 patch-4.2-rc4.xz
|
8c9a9889e1994c220e9794ffc54301f2 patch-4.2-rc4.xz
|
||||||
e73e50e7875fca09808d655dd0acb7a7 patch-4.2-rc4-git1.xz
|
568a8c0cb98100d3ef6f45ea1123b310 patch-4.2-rc4-git2.xz
|
||||||
|
Loading…
Reference in New Issue
Block a user