diff options
| author | Tetsuo Handa <[email protected]> | 2011-02-07 13:36:10 +0000 |
|---|---|---|
| committer | Linus Torvalds <[email protected]> | 2011-02-07 22:04:00 +0000 |
| commit | 2edeaa34a6e3f2c43b667f6c4f7b27944b811695 (patch) | |
| tree | 37dd9156645491a86844ba9198fe05e4e6fe44c5 /net/unix/af_unix.c | |
| parent | Merge git://git.kernel.org/pub/scm/linux/kernel/git/sfrench/cifs-2.6 (diff) | |
| download | kernel-2edeaa34a6e3f2c43b667f6c4f7b27944b811695.tar.gz kernel-2edeaa34a6e3f2c43b667f6c4f7b27944b811695.zip | |
CRED: Fix BUG() upon security_cred_alloc_blank() failure
In cred_alloc_blank() since 2.6.32, abort_creds(new) is called with
new->security == NULL and new->magic == 0 when security_cred_alloc_blank()
returns an error. As a result, BUG() will be triggered if SELinux is enabled
or CONFIG_DEBUG_CREDENTIALS=y.
If CONFIG_DEBUG_CREDENTIALS=y, BUG() is called from __invalid_creds() because
cred->magic == 0. Failing that, BUG() is called from selinux_cred_free()
because selinux_cred_free() is not expecting cred->security == NULL. This does
not affect smack_cred_free(), tomoyo_cred_free() or apparmor_cred_free().
Fix these bugs by
(1) Set new->magic before calling security_cred_alloc_blank().
(2) Handle null cred->security in creds_are_invalid() and selinux_cred_free().
Signed-off-by: Tetsuo Handa <[email protected]>
Signed-off-by: David Howells <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions