[Security] Keys: Fix oops when adding key to non-keyring
authorDavid Howells <dhowells@redhat.com>
Mon, 10 Apr 2006 14:15:21 +0000 (15:15 +0100)
committerLinus Torvalds <torvalds@g5.osdl.org>
Mon, 10 Apr 2006 16:33:46 +0000 (09:33 -0700)
commitc3a9d6541f84ac3ff566982d08389b87c1c36b4e
tree161e507b276105b35dadf0c2637be9f018b0f664
parent460fbf82c0842cad3f3c744c4dcb81978b7829f3
[Security] Keys: Fix oops when adding key to non-keyring

This fixes the problem of an oops occuring when a user attempts to add a
key to a non-keyring key [CVE-2006-1522].

The problem is that __keyring_search_one() doesn't check that the
keyring it's been given is actually a keyring.

I've fixed this problem by:

 (1) declaring that caller of __keyring_search_one() must guarantee that
     the keyring is a keyring; and

 (2) making key_create_or_update() check that the keyring is a keyring,
     and return -ENOTDIR if it isn't.

This can be tested by:

keyctl add user b b `keyctl add user a a @s`

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@osdl.org>
security/keys/key.c
security/keys/keyring.c