linux

mirror of https://github.com/raspberrypi/linux.git synced 2025-12-07 18:40:10 +00:00

Files

Eric Biggers d2d576e285 FS-Cache: fix dereference of NULL user_key_payload

commit d124b2c53c upstream.

When the file /proc/fs/fscache/objects (available with
CONFIG_FSCACHE_OBJECT_LIST=y) is opened, we request a user key with
description "fscache:objlist", then access its payload.  However, a
revoked key has a NULL payload, and we failed to check for this.
request_key() *does* skip revoked keys, but there is still a window
where the key can be revoked before we access its payload.

Fix it by checking for a NULL payload, treating it like a key which was
already revoked at the time it was requested.

Fixes: 4fbf4291aa ("FS-Cache: Allow the current state of all objects to be dumped")
Reviewed-by: James Morris <james.l.morris@oracle.com>
Signed-off-by: Eric Biggers <ebiggers@google.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2017-10-27 10:38:11 +02:00

cache.c

fs/fscache: convert printk to pr_foo()

2014-06-04 16:53:51 -07:00

cookie.c

fscache: Clear outstanding writes when disabling a cookie

2017-06-17 06:41:52 +02:00

fsdef.c

FS-Cache: Provide the ability to enable/disable cookies

2013-09-27 18:40:25 +01:00

histogram.c

drop redundant ->owner initializations