David Howells 23fd78d764 KEYS: Fix multiple key add into associative array ... If sufficient keys (or keyrings) are added into a keyring such that a node in the associative array's tree overflows (each node has a capacity N, currently 16) and such that all N+1 keys have the same index key segment for that level of the tree (the level'th nibble of the index key), then assoc_array_insert() calls ops->diff_objects() to indicate at which bit position the two index keys vary. However, __key_link_begin() passes a NULL object to assoc_array_insert() with the intention of supplying the correct pointer later before we commit the change. This means that keyring_diff_objects() is given a NULL pointer as one of its arguments which it does not expect. This results in an oops like the attached. With the previous patch to fix the keyring hash function, this can be forced much more easily by creating a keyring and only adding keyrings to it. Add any other sort of key and a different insertion path is taken - all 16+1 objects must want to cluster in the same node slot. This can be tested by: r=`keyctl newring sandbox @s` for ((i=0; i<=16; i++)); do keyctl newring ring$i $r; done This should work fine, but oopses when the 17th keyring is added. Since ops->diff_objects() is always called with the first pointer pointing to the object to be inserted (ie. the NULL pointer), we can fix the problem by changing the to-be-inserted object pointer to point to the index key passed into assoc_array_insert() instead. Whilst we're at it, we also switch the arguments so that they are the same as for ->compare_object(). BUG: unable to handle kernel NULL pointer dereference at 0000000000000088 IP: [<ffffffff81191ee4>] hash_key_type_and_desc+0x18/0xb0 ... RIP: 0010:[<ffffffff81191ee4>] hash_key_type_and_desc+0x18/0xb0 ... Call Trace: [<ffffffff81191f9d>] keyring_diff_objects+0x21/0xd2 [<ffffffff811f09ef>] assoc_array_insert+0x3b6/0x908 [<ffffffff811929a7>] __key_link_begin+0x78/0xe5 [<ffffffff81191a2e>] key_create_or_update+0x17d/0x36a [<ffffffff81192e0a>] SyS_add_key+0x123/0x183 [<ffffffff81400ddb>] tracesys+0xdd/0xe2 Signed-off-by: David Howells <dhowells@redhat.com> Tested-by: Stephen Gallagher <sgallagh@redhat.com>		2013-12-02 11:24:18 +00:00
..
fonts	lib: Move fonts from drivers/video/console/ to lib/fonts/	2013-06-28 10:28:22 +02:00
lz4	lz4: fix compression/decompression signedness mismatch	2013-09-11 15:59:45 -07:00
lzo	lib/lzo: Update LZO compression to current upstream version	2013-02-20 19:36:01 +01:00
mpi	MPILIB: add module description and license	2013-09-25 17:17:01 +01:00
raid6	md update for v3.12	2013-09-10 13:03:41 -07:00
reed_solomon	…
xz	decompressors: fix typo "POWERPC"	2013-03-13 15:21:48 -07:00
zlib_deflate	…
zlib_inflate	…
.gitignore	…
Kconfig	Merge branch 'for-linus2' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security	2013-11-21 19:46:00 -08:00
Kconfig.debug	percpu: add test module for various percpu operations	2013-11-13 12:09:11 +09:00
Kconfig.kgdb	treewide: Fix typo in printk	2013-06-18 13:48:45 +02:00
Kconfig.kmemcheck	…
Makefile	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending	2013-11-22 10:52:03 -08:00
argv_split.c	argv_split(): teach it to handle mutable strings	2013-04-29 18:28:19 -07:00
asn1_decoder.c	Nothing all that exciting; a new module-from-fd syscall for those who want	2012-12-19 07:55:08 -08:00
assoc_array.c	KEYS: Fix multiple key add into associative array	2013-12-02 11:24:18 +00:00
atomic64.c	lib: atomic64: Initialize locks statically to fix early users	2012-12-20 13:50:16 -08:00
atomic64_test.c	…
audit.c	…
average.c	…
bcd.c	…
bch.c	…
bitmap.c	propagate name change to comments in kernel source	2012-12-06 10:39:54 +01:00
bitrev.c	…
bsearch.c	…
btree.c	…
bug.c	taint: add explicit flag to show whether lock dep is still OK.	2013-01-21 17:17:57 +10:30
build_OID_registry	X.509: do not emit any informational output	2013-06-19 17:54:06 +02:00
bust_spinlocks.c	printk: Provide a wake_up_klogd() off-case	2013-03-22 16:41:20 -07:00
check_signature.c	…
checksum.c	asm-generic headers: Allow yet more arch overrides in checksum.h	2013-02-11 20:00:33 +05:30
clz_ctz.c	lib: add weak clz/ctz functions	2013-07-09 10:33:30 -07:00
clz_tab.c	…
cmdline.c	…
cordic.c	…
cpu-notifier-error-inject.c	…
cpu_rmap.c	Remove GENERIC_HARDIRQ config option	2013-09-13 15:09:52 +02:00
cpumask.c	bootmem: fix wrong call parameter for free_bootmem()	2012-12-11 17:22:28 -08:00
crc-ccitt.c	…
crc-itu-t.c	…
crc-t10dif.c	crypto: crct10dif - Add fallback for broken initrds	2013-09-12 15:31:34 +10:00
crc7.c	…
crc8.c	…
crc16.c	…
crc32.c	lib: crc32: reduce number of cases for crc32{, c}_combine	2013-11-04 15:27:08 -05:00
crc32defs.h	…
ctype.c	…
debug_locks.c	mutex: Add support for wound/wait style locks	2013-06-26 12:10:56 +02:00
debugobjects.c	lib/debugobjects.c: remove unnecessary work pending test	2013-11-13 12:09:22 +09:00
dec_and_lock.c	…
decompress.c	lib: add support for LZ4-compressed kernel	2013-07-09 10:33:30 -07:00
decompress_bunzip2.c	…
decompress_inflate.c	lib/decompressors: fix "no limit" output buffer length	2013-09-11 15:58:38 -07:00
decompress_unlz4.c	lib: add support for LZ4-compressed kernel	2013-07-09 10:33:30 -07:00
decompress_unlzma.c	…
decompress_unlzo.c	lib/lzo: Rename lzo1x_decompress.c to lzo1x_decompress_safe.c	2013-02-20 19:36:00 +01:00
decompress_unxz.c	…
devres.c	lib/devres.c: fix misplaced #endif	2013-02-27 19:10:09 -08:00
digsig.c	lib/digsig.c: use ERR_CAST inlined function instead of ERR_PTR(PTR_ERR(...))	2013-11-13 12:09:22 +09:00
div64.c	math64: New separate div64_u64_rem helper	2013-08-23 09:02:14 -04:00
dma-debug.c	dma-debug: update DMA debug API to better handle multiple mappings of a buffer	2013-03-22 16:41:20 -07:00
dump_stack.c	x86, asmlinkage: Make dump_stack visible	2013-08-06 14:21:01 -07:00
dynamic_debug.c	dynamic debug: line queries failing due to uninitialized local variable	2013-08-28 12:10:53 -07:00
dynamic_queue_limits.c	…
earlycpio.c	earlycpio.c: Fix the confusing comment of find_cpio_data().	2013-08-14 23:24:01 +02:00
extable.c	…
fault-inject.c	debugfs: add get/set for atomic types	2013-06-03 13:55:01 -07:00
fdt.c	…
fdt_ro.c	…
fdt_rw.c	…
fdt_strerror.c	…
fdt_sw.c	…
fdt_wip.c	…
find_last_bit.c	…
find_next_bit.c	…
flex_array.c	…
flex_proportions.c	…
gcd.c	…
gen_crc32table.c	…
genalloc.c	lib/genalloc: add a helper function for DMA buffer allocation	2013-11-13 12:09:22 +09:00
halfmd4.c	…
hexdump.c	lib: introduce upper case hex ascii helpers	2013-09-20 15:38:26 -04:00
hweight.c	…
idr.c	idr: print a stack dump after ida_remove warning	2013-07-03 16:08:04 -07:00
inflate.c	…
int_sqrt.c	lib/int_sqrt.c: optimize square root algorithm	2013-04-29 18:28:19 -07:00
interval_tree.c	…
interval_tree_test_main.c	random32: rename random32 to prandom	2012-12-17 17:15:26 -08:00
iomap.c	…
iomap_copy.c	…
iommu-helper.c	…
ioremap.c	…
iovec.c	Hoist memcpy_fromiovec/memcpy_toiovec into lib/	2013-05-20 10:24:22 +09:30
irq_regs.c	…
is_single_threaded.c	…
jedec_ddr_data.c	…
kasprintf.c	…
kfifo.c	kfifo: kfifo_copy_{to,from}_user: fix copied bytes calculation	2013-11-15 09:32:23 +09:00
klist.c	klist: del waiter from klist_remove_waiters before wakeup waitting process	2013-05-21 10:16:39 -07:00
kobject.c	Revert "sysfs: drop kobj_ns_type handling"	2013-11-07 20:47:28 +09:00
kobject_uevent.c	…
kstrtox.c	kstrto*: add documentation	2012-12-17 17:15:22 -08:00
kstrtox.h	…
lcm.c	…
libcrc32c.c	…
list_debug.c	…
list_sort.c	lib/: rename random32() to prandom_u32()	2013-04-29 18:28:42 -07:00
llist.c	llists-move-llist_reverse_order-from-raid5-to-llistc-fix	2013-11-15 09:32:22 +09:00
locking-selftest-hardirq.h	…
locking-selftest-mutex.h	…
locking-selftest-rlock-hardirq.h	…
locking-selftest-rlock-softirq.h	…
locking-selftest-rlock.h	…
locking-selftest-rsem.h	…
locking-selftest-softirq.h	…
locking-selftest-spin-hardirq.h	…
locking-selftest-spin-softirq.h	…
locking-selftest-spin.h	…
locking-selftest-wlock-hardirq.h	…
locking-selftest-wlock-softirq.h	…
locking-selftest-wlock.h	…
locking-selftest-wsem.h	…
locking-selftest.c	sched: Introduce preempt_count accessor functions	2013-09-25 14:07:32 +02:00
lockref.c	lockref: include mutex.h rather than reinvent arch_mutex_cpu_relax	2013-11-27 20:37:33 -08:00
lru_cache.c	lru_cache: introduce lc_get_cumulative()	2013-03-22 22:17:36 -06:00
md5.c	…
memory-notifier-error-inject.c	…
memweight.c	…
net_utils.c	net: core: move mac_pton() to lib/net_utils.c	2013-06-05 12:00:27 -07:00
nlattr.c	…
notifier-error-inject.c	mode_t, whack-a-mole at 11...	2013-04-09 14:13:05 -04:00
notifier-error-inject.h	…
of-reconfig-notifier-error-inject.c	powerpc+of: Rename and fix OF reconfig notifier error inject module	2012-12-14 10:32:52 +11:00
oid_registry.c	Give the OID registry file module info to avoid kernel tainting	2013-05-05 14:38:00 -07:00
parser.c	lib/parser.c: fix up comments for valid return values from match_number	2013-02-21 17:22:25 -08:00
pci_iomap.c	…
percpu-refcount.c	percpu-refcount: Add EXPORT_SYMBOL to use percpu_ref from modules	2013-11-07 12:14:52 -08:00
percpu_counter.c	percpu_counter: make APIs irq safe	2013-10-25 11:55:59 +01:00
percpu_ida.c	Merge branch 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending	2013-11-22 10:52:03 -08:00
percpu_test.c	percpu: add test module for various percpu operations	2013-11-13 12:09:11 +09:00
plist.c	…
pm-notifier-error-inject.c	…
prio_heap.c	…
proportions.c	…
radix-tree.c	lib/radix-tree.c: make radix_tree_node_alloc() work correctly within interrupt	2013-09-11 15:59:36 -07:00
random32.c	random32: use msecs_to_jiffies for reseed timer	2013-11-14 16:06:02 -05:00
ratelimit.c	…
rational.c	…
rbtree.c	rbtree: add postorder iteration functions	2013-09-11 15:59:19 -07:00
rbtree_test.c	rbtree_test: add test for postorder iteration	2013-09-11 15:59:20 -07:00
reciprocal_div.c	…
scatterlist.c	lib/scatterlist.c: don't flush_kernel_dcache_page on slab page	2013-10-31 16:58:13 -07:00
sha1.c	…
show_mem.c	mm: do not walk all of system memory during show_mem	2013-11-13 12:09:09 +09:00
smp_processor_id.c	sched: Introduce preempt_count accessor functions	2013-09-25 14:07:32 +02:00
sort.c	…
stmp_device.c	…
string.c	…
string_helpers.c	lib/string_helpers: introduce generic string_unescape	2013-04-30 17:04:03 -07:00
strncpy_from_user.c	…
strnlen_user.c	…
swiotlb.c	Merge remote-tracking branch 'stefano/swiotlb-xen-9.1' into stable/for-linus-3.13	2013-11-08 16:10:48 -05:00
syscall.c	…
test-kstrtox.c	…
test-string_helpers.c	lib/string_helpers: introduce generic string_unescape	2013-04-30 17:04:03 -07:00
textsearch.c	…
timerqueue.c	…
ts_bm.c	…
ts_fsm.c	…
ts_kmp.c	…
ucs2_string.c	Move utf16 functions to kernel core and rename	2013-04-15 21:23:03 +01:00
usercopy.c	Kconfig: consolidate CONFIG_DEBUG_STRICT_USER_COPY_CHECKS	2013-04-30 17:04:09 -07:00
uuid.c	uuid: use prandom_bytes()	2013-04-29 18:28:42 -07:00
vsprintf.c	vsprintf: ignore %n again	2013-11-15 09:32:20 +09:00