diff options
Diffstat (limited to 'recipes-kernel/linux/linux-hierofalcon-4.1/keys-CVE-2015-1333.patch')
-rw-r--r-- | recipes-kernel/linux/linux-hierofalcon-4.1/keys-CVE-2015-1333.patch | 52 |
1 files changed, 52 insertions, 0 deletions
diff --git a/recipes-kernel/linux/linux-hierofalcon-4.1/keys-CVE-2015-1333.patch b/recipes-kernel/linux/linux-hierofalcon-4.1/keys-CVE-2015-1333.patch new file mode 100644 index 0000000..5927c50 --- /dev/null +++ b/recipes-kernel/linux/linux-hierofalcon-4.1/keys-CVE-2015-1333.patch | |||
@@ -0,0 +1,52 @@ | |||
1 | From 4fd5dc9eece297f49f16f82422ead3a28b11ea70 Mon Sep 17 00:00:00 2001 | ||
2 | From: Colin Ian King <colin.king@canonical.com> | ||
3 | Date: Mon, 27 Jul 2015 15:23:43 +0100 | ||
4 | Subject: [PATCH] KEYS: ensure we free the assoc array edit if edit is valid | ||
5 | |||
6 | commit ca4da5dd1f99fe9c59f1709fb43e818b18ad20e0 upstream. | ||
7 | |||
8 | __key_link_end is not freeing the associated array edit structure | ||
9 | and this leads to a 512 byte memory leak each time an identical | ||
10 | existing key is added with add_key(). | ||
11 | |||
12 | The reason the add_key() system call returns okay is that | ||
13 | key_create_or_update() calls __key_link_begin() before checking to see | ||
14 | whether it can update a key directly rather than adding/replacing - which | ||
15 | it turns out it can. Thus __key_link() is not called through | ||
16 | __key_instantiate_and_link() and __key_link_end() must cancel the edit. | ||
17 | |||
18 | CVE-2015-1333 | ||
19 | |||
20 | Upstream-Status: Backport | ||
21 | |||
22 | Signed-off-by: Colin Ian King <colin.king@canonical.com> | ||
23 | Signed-off-by: David Howells <dhowells@redhat.com> | ||
24 | Signed-off-by: James Morris <james.l.morris@oracle.com> | ||
25 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | ||
26 | Signed-off-by: Sona Sarmadi <sona.sarmadi@enea.com> | ||
27 | --- | ||
28 | security/keys/keyring.c | 8 +++++--- | ||
29 | 1 file changed, 5 insertions(+), 3 deletions(-) | ||
30 | |||
31 | diff --git a/security/keys/keyring.c b/security/keys/keyring.c | ||
32 | index e72548b..d334370 100644 | ||
33 | --- a/security/keys/keyring.c | ||
34 | +++ b/security/keys/keyring.c | ||
35 | @@ -1181,9 +1181,11 @@ void __key_link_end(struct key *keyring, | ||
36 | if (index_key->type == &key_type_keyring) | ||
37 | up_write(&keyring_serialise_link_sem); | ||
38 | |||
39 | - if (edit && !edit->dead_leaf) { | ||
40 | - key_payload_reserve(keyring, | ||
41 | - keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
42 | + if (edit) { | ||
43 | + if (!edit->dead_leaf) { | ||
44 | + key_payload_reserve(keyring, | ||
45 | + keyring->datalen - KEYQUOTA_LINK_BYTES); | ||
46 | + } | ||
47 | assoc_array_cancel_edit(edit); | ||
48 | } | ||
49 | up_write(&keyring->sem); | ||
50 | -- | ||
51 | 1.9.1 | ||
52 | |||