Oleg Nesterov fbb67524e8 cred: copy_process() should clear child->replacement_session_keyring ...

commit 79549c6dfd upstream.

keyctl_session_to_parent(task) sets ->replacement_session_keyring,
it should be processed and cleared by key_replace_session_keyring().

However, this task can fork before it notices TIF_NOTIFY_RESUME and
the new child gets the bogus ->replacement_session_keyring copied by
dup_task_struct(). This is obviously wrong and, if nothing else, this
leads to put_cred(already_freed_cred).

change copy_creds() to clear this member. If copy_process() fails
before this point the wrong ->replacement_session_keyring doesn't
matter, exit_creds() won't be called.

Signed-off-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2012-04-13 08:33:50 -07:00

..

debug

kgdb,debug_core: pass the breakpoint struct instead of address and memory

2012-04-13 08:33:48 -07:00

events

perf events: Fix ring_buffer_wakeup() brown paperbag bug

2011-12-14 08:44:53 +01:00

gcov

gcov: disable CONSTRUCTORS for UML

2011-07-26 16:49:45 -07:00

irq

genirq: Adjust irq thread affinity on IRQ_SET_MASK_OK_NOCOPY return value

2012-04-13 08:33:46 -07:00

power

PM / Hibernate: Enable usermodehelpers in hibernate() error path

2012-04-02 09:53:03 -07:00

time

ntp: Fix integer overflow when setting time

2012-04-02 09:52:35 -07:00

trace

tracing: Fix ent_size in trace output

2012-04-13 08:33:47 -07:00

.gitignore

…

acct.c

…

async.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

audit_tree.c

audit_tree,rcu: Convert call_rcu(__put_tree) to kfree_rcu()

2011-07-20 14:10:11 -07:00

audit_watch.c

kill path_lookup()

2011-03-14 09:15:23 -04:00

audit.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

audit.h

audit: make functions static

2010-10-30 01:42:19 -04:00

auditfilter.c

netlink: kill loginuid/sessionid/sid members from struct netlink_skb_parms

2011-03-03 10:55:40 -08:00

auditsc.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

backtracetest.c

…

bounds.c

memcg: remove direct page_cgroup-to-page pointer

2011-03-23 19:46:28 -07:00

capability.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

cgroup_freezer.c

cgroup_freezer: fix freezing groups with stopped tasks

2011-11-24 11:58:22 -08:00

cgroup.c

cgroup: fix to allow mounting a hierarchy by name

2012-01-12 11:29:35 -08:00

compat.c

kernel: Fix files explicitly needing EXPORT_SYMBOL infrastructure

2011-10-31 19:30:05 -04:00

configs.c

kernel/configs.c: include MODULE_*() when CONFIG_IKCONFIG_PROC=n

2011-07-25 20:57:15 -07:00

cpu_pm.c

cpu_pm: call notifiers during suspend

2011-09-23 12:05:29 +05:30

cpu.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

cpuset.c

cpusets: stall when updating mems_allowed for mempolicy or disjoint nodemask

2011-12-20 10:25:04 -08:00

crash_dump.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

cred.c

cred: copy_process() should clear child->replacement_session_keyring

2012-04-13 08:33:50 -07:00

delayacct.c

KVM: Steal time implementation

2011-07-14 12:59:14 +03:00

dma.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

elfcore.c

…

exec_domain.c

…

exit.c

ptrace: partially fix the do_wait(WEXITED) vs EXIT_DEAD->EXIT_ZOMBIE race

2012-01-04 15:01:59 -08:00

extable.c

extable, core_kernel_data(): Make sure all archs define _sdata

2011-05-20 08:56:56 +02:00

fork.c

epoll: introduce POLLFREE to flush ->signalfd_wqh before kfree()

2012-02-29 16:31:23 -08:00

freezer.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

futex_compat.c

userns: user namespaces: convert several capable() calls

2011-03-23 19:47:08 -07:00

futex.c

futex: Cover all PI opcodes with cmpxchg enabled check

2012-04-02 09:52:30 -07:00

groups.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

hrtimer.c

Merge branch 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2011-11-28 08:43:52 -08:00

hung_task.c

hung_task: fix false positive during vfork

2012-01-03 16:14:32 -08:00

irq_work.c

kernel: fix two implicit header assumptions in irq_work.c

2011-10-31 09:20:12 -04:00

itimer.c

…

jump_label.c

jump_label: jump_label_inc may return before the code is patched

2011-12-05 13:28:46 -05:00

kallsyms.c

Merge branch 'core-fixes-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip

2011-03-25 17:52:22 -07:00

Kconfig.freezer

…

Kconfig.hz

…

Kconfig.locks

arch:Kconfig.locks Remove unused config option.

2011-04-10 17:01:05 +02:00

Kconfig.preempt

sched: Isolate preempt counting in its own config option

2011-06-10 15:15:40 +02:00

kexec.c

[S390] kdump: Add infrastructure for unmapping crashkernel memory

2011-10-30 15:16:42 +01:00

kfifo.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

kmod.c

kmod: prevent kmod_loop_msg overflow in __request_module()

2011-10-26 13:10:39 +10:30

kprobes.c

kprobes: return proper error code from register_kprobe()

2012-03-12 12:31:26 -07:00

ksysfs.c

kernel: ksysfs.c is implicitly using stat.h

2011-10-31 09:20:13 -04:00

kthread.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

latencytop.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

lockdep_internals.h

…

lockdep_proc.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

lockdep_states.h

…

lockdep.c

lockdep, kmemcheck: Annotate ->lock in lockdep_init_map()

2011-12-06 18:18:13 +01:00

Makefile

Merge branch 'devel-stable' of http://ftp.arm.linux.org.uk/pub/linux/arm/kernel/git-cur/linux-2.6-arm

2011-10-28 12:02:27 -07:00

module.c

module: Remove module size limit

2012-04-02 09:53:07 -07:00

mutex-debug.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

mutex-debug.h

mutex: Use p->on_cpu for the adaptive spin

2011-04-14 08:52:33 +02:00

mutex.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

mutex.h

mutex: Use p->on_cpu for the adaptive spin

2011-04-14 08:52:33 +02:00

notifier.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

nsproxy.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

padata.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

panic.c

lockdep, bug: Exclude TAINT_OOT_MODULE from disabling lock debugging

2012-02-13 11:16:59 -08:00

params.c

kernel: params.c needs module.h not moduleparam.h

2011-10-31 09:20:13 -04:00

pid_namespace.c

pidns: call pid_ns_prepare_proc() from create_pid_namespace()

2011-03-23 19:46:58 -07:00

pid.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

posix-cpu-timers.c

Merge branch 'core-locking-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

2011-10-26 16:17:32 +02:00

posix-timers.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

printk.c

printk: avoid double lock acquire

2011-12-09 07:50:28 -08:00

profile.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

ptrace.c

ptrace: ensure JOBCTL_STOP_SIGMASK is not zero after detach

2012-01-04 15:01:59 -08:00

range.c

range: fix bogus misuse of module.h to get printk()

2011-10-31 09:20:11 -04:00

rcu.h

rcu: Add grace-period, quiescent-state, and call_rcu trace events

2011-09-28 21:38:21 -07:00

rcupdate.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

rcutiny_plugin.h

kernel: fix up module header handling in rcutiny files

2011-10-31 09:20:13 -04:00

rcutiny.c

kernel: fix up module header handling in rcutiny files

2011-10-31 09:20:13 -04:00

rcutorture.c

rcu: Make rcu_torture_boost() exit loops at end of test

2011-09-28 21:38:46 -07:00

rcutree_plugin.h

rcu: Remove rcu_needs_cpu_flush() to avoid false quiescent states

2011-09-28 21:38:48 -07:00

rcutree_trace.c

rcu: Simplify quiescent-state accounting

2011-09-28 21:38:22 -07:00

rcutree.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

rcutree.h

rcu: Remove rcu_needs_cpu_flush() to avoid false quiescent states

2011-09-28 21:38:48 -07:00

relay.c

relay: prevent integer overflow in relay_open()

2012-02-20 12:46:16 -08:00

res_counter.c

memcg: res_counter_read_u64(): fix potential races on 32-bit machines

2011-03-23 19:46:22 -07:00

resource.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

rtmutex_common.h

rtmutex: Simplify PI algorithm and make highest prio task get lock

2011-01-27 21:13:51 -05:00

rtmutex-debug.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

rtmutex-debug.h

…

rtmutex-tester.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

rtmutex.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

rtmutex.h

…

rwsem.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

sched_autogroup.c

Fix common misspellings

2011-03-31 11:26:23 -03:00

sched_autogroup.h

sched: Skip autogroup when looking for all rt sched groups

2011-07-01 10:39:08 +02:00

sched_clock.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

sched_cpupri.c

sched/cpupri: Remove cpupri->pri_active

2011-08-14 12:01:11 +02:00

sched_cpupri.h

sched/cpupri: Remove cpupri->pri_active

2011-08-14 12:01:11 +02:00

sched_debug.c

sched: Get rid of lock_depth

2011-04-24 13:18:38 +02:00

sched_fair.c

sched: Fix select_idle_sibling() regression in selecting an idle SMT sibling

2011-12-16 09:44:58 +01:00

sched_features.h

sched, rt: Provide means of disabling cross-cpu bandwidth sharing

2011-11-14 12:50:40 +01:00

sched_idletask.c

sched: Drop the rq argument to sched_class::select_task_rq()

2011-04-14 08:52:36 +02:00

sched_rt.c

sched/rt: Fix task stack corruption under __ARCH_WANT_INTERRUPTS_ON_CTXSW

2012-02-13 11:16:56 -08:00

sched_stats.h

locking, sched: Annotate thread_group_cputimer as raw

2011-09-13 11:11:55 +02:00

sched_stoptask.c

sched: Implement hierarchical task accounting for SCHED_OTHER

2011-08-14 12:01:13 +02:00

sched.c

sched: Set the command name of the idle tasks in SMP kernels

2011-11-14 12:50:43 +01:00

seccomp.c

…

semaphore.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

signal.c

ptrace: ensure JOBCTL_STOP_SIGMASK is not zero after detach

2012-01-04 15:01:59 -08:00

smp.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

softirq.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

spinlock.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

srcu.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

stacktrace.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

stop_machine.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

sys_ni.c

Cross Memory Attach

2011-10-31 17:30:44 -07:00

sys.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

sysctl_binary.c

binary_sysctl(): fix memory leak

2011-12-20 10:25:04 -08:00

sysctl_check.c

xfs: remove subdirectories

2011-08-12 16:21:35 -05:00

sysctl.c

sysctl: fix write access to dmesg_restrict/kptr_restrict

2012-04-13 08:33:49 -07:00

taskstats.c

Make TASKSTATS require root access

2011-09-19 17:04:37 -07:00

test_kprobes.c

…

time.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

timeconst.pl

…

timer.c

sys_getppid: add missing rcu_dereference

2011-12-09 07:50:29 -08:00

tracepoint.c

tracepoints/module: Fix disabling tracepoints with taint CRAP or OOT

2012-01-25 16:13:52 -08:00

tsacct.c

Make taskstats round statistics down to nearest 1k bytes/events

2011-09-19 17:10:57 -07:00

uid16.c

userns: user namespaces: convert several capable() calls

2011-03-23 19:47:08 -07:00

up.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

user_namespace.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

user-return-notifier.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

user.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

utsname_sysctl.c

Merge branch 'modsplit-Oct31_2011' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux

2011-11-06 19:44:47 -08:00

utsname.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

wait.c

kernel: Map most files to use export.h instead of module.h

2011-10-31 09:20:12 -04:00

watchdog.c

watchdog: move watchdog_*_all_cpus under CONFIG_SYSCTL

2011-10-31 17:30:53 -07:00

workqueue_sched.h

…

workqueue.c

Block: use a freezable workqueue for disk-event polling

2012-03-19 09:02:34 -07:00