The patch titled
keys: fix key serial number collision handling
has been removed from the -mm tree. Its filename was
keys-fix-key-serial-number-collision-handling.patch
This patch was dropped because it was merged into mainline or a subsystem tree
------------------------------------------------------
Subject: keys: fix key serial number collision handling
From: David Howells <dhowells@xxxxxxxxxx>
Fix the key serial number collision avoidance code in key_alloc_serial().
This didn't use to be so much of a problem as the key serial numbers were
allocated from a simple incremental counter, and it would have to go
through two billion keys before it could possibly encounter a collision.
However, now that random numbers are used instead, collisions are much more
likely.
This is fixed by finding a hole in the rbtree where the next unused serial
number ought to be and using that by going almost back to the top of the
insertion routine and redoing the insertion with the new serial number
rather than trying to be clever and attempting to work out the insertion
point pointer directly.
This fixes kernel BZ #7727.
Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
Cc: <stable@xxxxxxxxxx>
Cc: <support@xxxxxxxxxxxxx>
Signed-off-by: Andrew Morton <akpm@xxxxxxxxxxxxxxxxxxxx>
---
security/keys/key.c | 33 ++++++++++++++-------------------
1 files changed, 14 insertions(+), 19 deletions(-)
diff -puN security/keys/key.c~keys-fix-key-serial-number-collision-handling security/keys/key.c
--- a/security/keys/key.c~keys-fix-key-serial-number-collision-handling
+++ a/security/keys/key.c
@@ -188,6 +188,7 @@ static inline void key_alloc_serial(stru
spin_lock(&key_serial_lock);
+attempt_insertion:
parent = NULL;
p = &key_serial_tree.rb_node;
@@ -202,39 +203,33 @@ static inline void key_alloc_serial(stru
else
goto serial_exists;
}
- goto insert_here;
+
+ /* we've found a suitable hole - arrange for this key to occupy it */
+ rb_link_node(&key->serial_node, parent, p);
+ rb_insert_color(&key->serial_node, &key_serial_tree);
+
+ spin_unlock(&key_serial_lock);
+ return;
/* we found a key with the proposed serial number - walk the tree from
* that point looking for the next unused serial number */
serial_exists:
for (;;) {
key->serial++;
- if (key->serial < 2)
- key->serial = 2;
-
- if (!rb_parent(parent))
- p = &key_serial_tree.rb_node;
- else if (rb_parent(parent)->rb_left == parent)
- p = &(rb_parent(parent)->rb_left);
- else
- p = &(rb_parent(parent)->rb_right);
+ if (key->serial < 3) {
+ key->serial = 3;
+ goto attempt_insertion;
+ }
parent = rb_next(parent);
if (!parent)
- break;
+ goto attempt_insertion;
xkey = rb_entry(parent, struct key, serial_node);
if (key->serial < xkey->serial)
- goto insert_here;
+ goto attempt_insertion;
}
- /* we've found a suitable hole - arrange for this key to occupy it */
-insert_here:
- rb_link_node(&key->serial_node, parent, p);
- rb_insert_color(&key->serial_node, &key_serial_tree);
-
- spin_unlock(&key_serial_lock);
-
} /* end key_alloc_serial() */
/*****************************************************************************/
_
Patches currently in -mm which might be from dhowells@xxxxxxxxxx are
origin.patch
git-alsa.patch
infiniband-work-around-gcc-bug-on-sparc64.patch
git-cryptodev.patch
doc-atomic_add_unless-doesnt-imply-mb-on-failure.patch
remove-references-to-obsolete-kernel-config-option-debug_rwsems.patch
aio-use-flush_work.patch
kblockd-use-flush_work.patch
relayfs-use-flush_keventd_work.patch
tg3-use-flush_keventd_work.patch
e1000-use-flush_keventd_work.patch
libata-use-flush_work.patch
phy-use-flush_work.patch
ecryptfs-public-key-transport-mechanism.patch
ecryptfs-public-key-packet-management.patch
dynamic-kernel-command-line-common.patch
dynamic-kernel-command-line-frv.patch
reiser4-get_sb_dev-fix.patch
sysctl-frv-pm-remove-unnecessary-insert_at_head-flag.patch
sysctl-move-ctl_frv-into-sysctlh-where-it-belongs.patch
sysctl-frv-remove-unnecessary-insert_at_head-flag.patch
sysctl-c99-convert-arch-frv-kernel-pmc.patch
sysctl-c99-convert-arch-frv-kernel-sysctlc.patch
mutex-subsystem-synchro-test-module.patch
-
To unsubscribe from this list: send the line "unsubscribe mm-commits" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
