David Howells ce19c70f30 keys: Do not cache key in task struct if key is requested from kernel thread ... [ Upstream commit 47f9e4c924 ] The key which gets cached in task structure from a kernel thread does not get invalidated even after expiry. Due to which, a new key request from kernel thread will be served with the cached key if it's present in task struct irrespective of the key validity. The change is to not cache key in task_struct when key requested from kernel thread so that kernel thread gets a valid key on every key request. The problem has been seen with the cifs module doing DNS lookups from a kernel thread and the results getting pinned by being attached to that kernel thread's cache - and thus not something that can be easily got rid of. The cache would ordinarily be cleared by notify-resume, but kernel threads don't do that. This isn't seen with AFS because AFS is doing request_key() within the kernel half of a user thread - which will do notify-resume. Fixes: 7743c48e54 ("keys: Cache result of request_key*() temporarily in task_struct") Signed-off-by: Bharath SM <bharathsm@microsoft.com> Signed-off-by: David Howells <dhowells@redhat.com> Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org> cc: Shyam Prasad N <nspmangalore@gmail.com> cc: Steve French <smfrench@gmail.com> cc: keyrings@vger.kernel.org cc: linux-cifs@vger.kernel.org cc: linux-fsdevel@vger.kernel.org Link: https://lore.kernel.org/r/CAGypqWw951d=zYRbdgNR4snUDvJhWL=q3=WOyh7HhSJupjz2vA@mail.gmail.com/ Signed-off-by: Sasha Levin <sashal@kernel.org>		2023-03-30 12:47:47 +02:00
..
apparmor	apparmor: Fix memleak in alloc_ns()	2022-12-31 13:14:22 +01:00
bpf	…
integrity	ima: Align ima_file_mmap() parameters with mmap_file LSM hook	2023-03-10 09:40:03 +01:00
keys	keys: Do not cache key in task struct if key is requested from kernel thread	2023-03-30 12:47:47 +02:00
landlock	landlock: Fix same-layer rule unions	2022-06-09 10:23:24 +02:00
loadpin	LoadPin: Ignore the "contents" argument of the LSM hooks	2022-12-31 13:14:45 +01:00
lockdown	…
safesetid	…
selinux	selinux: enable use of both GFP_KERNEL and GFP_ATOMIC in convert_context()	2022-10-29 10:12:54 +02:00
smack	Fix incorrect type in assignment of ipv6 port for audit	2022-04-08 14:23:55 +02:00
tomoyo	tomoyo: fix broken dependency on *.conf.default	2023-02-01 08:27:05 +01:00
yama	…
Kconfig	x86/retbleed: Add fine grained Kconfig knobs	2022-07-23 12:54:10 +02:00
Kconfig.hardening	security: Restrict CONFIG_ZERO_CALL_USED_REGS to gcc or clang > 15.0.6	2022-12-31 13:14:46 +01:00
Makefile	security: remove unneeded subdir-$(CONFIG_...)	2021-09-03 08:17:20 +09:00
commoncap.c	capabilities: fix potential memleak on error path from vfs_getxattr_alloc()	2022-11-10 18:15:39 +01:00
device_cgroup.c	device_cgroup: Roll back to original exceptions after copy failure	2023-01-12 11:58:59 +01:00
inode.c	…
lsm_audit.c	…
min_addr.c	…
security.c	ima: Align ima_file_mmap() parameters with mmap_file LSM hook	2023-03-10 09:40:03 +01:00