Eric Lee / smarc-ti-linux-kernel | Embedian Git Server

Commit 97826c821ec6724fc359d9b7840dc10af914c641

Authored by David Howells 2013-11-14 00:51:06 +0800

Exists in master and in 16 other branches

KEYS: Fix error handling in big_key instantiation

In the big_key_instantiate() function we return 0 if kernel_write() returns us
an error rather than returning an error.  This can potentially lead to
dentry_open() giving a BUG when called from big_key_read() with an unset
tmpfile path.

	------------[ cut here ]------------
	kernel BUG at fs/open.c:798!
	...
	RIP: 0010:[<ffffffff8119bbd1>] dentry_open+0xd1/0xe0
	...
	Call Trace:
	 [<ffffffff812350c5>] big_key_read+0x55/0x100
	 [<ffffffff81231084>] keyctl_read_key+0xb4/0xe0
	 [<ffffffff81231e58>] SyS_keyctl+0xf8/0x1d0
	 [<ffffffff815bb799>] system_call_fastpath+0x16/0x1b


Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Stephen Gallagher <sgallagh@redhat.com>

Showing 1 changed file with 1 additions and 0 deletions Side-by-side Diff

security/keys/big_key.c

security/keys/big_key.c

Diff comments View file @ 97826c8

...	...	@@ -78,6 +78,7 @@
78	78
79	79	written = kernel_write(file, prep->data, prep->datalen, 0);
80	80	if (written != datalen) {
	81	+ ret = written;
81	82	if (written >= 0)
82	83	ret = -ENOMEM;
83	84	goto err_fput;