KEYRINGS: find_keyring_by_name() can gain the freed keyring
in [Kernel]
|
Prev: [PATCH] suppress warning fs/quota/dquot.c:135: ‘quotatypes’ defined but not used
Next: USBIP (staging) driver's dependency on drivers/usb/core internal headers
From: Toshiyuki Okajima on 23 Apr 2010 06:50 Hi. Thanks for your comments. David Howells wrote: > Toshiyuki Okajima <toshi.okajima(a)jp.fujitsu.com> wrote: > >> With linux-2.6.34-rc5, find_keyring_by_name() can gain the keyring which has >> been already freed. And then, its space (which is gained by >> find_keyring_by_name()) is broken by accessing the freed keyring as the >> available keyring. > > Good catch! > > I'm not sure this is the best solution, though. This means that the keyring of which the count became 0 should not usually be used again? If yes, I think so, too. > > The alternative is just to ignore keys that have a zero usage count. OK. I applied your suggestion and I remade the patch. Then I confirmed that the system with new fix could continue to work while I was executing my reproducer and your reproducer. [your reproducer] > for ((i=0; i<100000; i++)); do keyctl session wibble /bin/true || break; done So, I think my new patch is also fixed. Please check it.(new patch is attached into the following mail.) Thanks, Toshiyuki Okajima -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo(a)vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/ |