[Devel] [PATCH RHEL7 COMMIT] ms/KEYS: Fix keyring ref leak in join_session_keyring()

[Konstantin Khorenko]

The commit is pushed to "branch-rh7-3.10.0-327.3.1-vz7.10.x-ovz" and will appear at https://src.openvz.org/scm/ovz/vzkernel.git
after rh7-3.10.0-327.3.1.vz7.10.6
------>
commit 2a9cbb74f8bbf4a2ebc0b9f7b25da0be335c90f1
Author: Cyrill Gorcunov <gorcunov at virtuozzo.com>
Date:   Mon Jan 25 20:15:08 2016 +0400

    ms/KEYS: Fix keyring ref leak in join_session_keyring()
    
    ML: 23567fd052a9abb6d67fe8e7a9ccdd9800a540f2
    
    From: Yevgeny Pats <yevgeny at perception-point.io>
    
    This fixes CVE-2016-0728.
    http://www.opennet.ru/opennews/art.shtml?num=43696
    
    If a thread is asked to join as a session keyring the keyring that's already
    set as its session, we leak a keyring reference.
    
    This can be tested with the following program:
    
    	#include <stddef.h>
    	#include <stdio.h>
    	#include <sys/types.h>
    	#include <keyutils.h>
    
    	int main(int argc, const char *argv[])
    	{
    		int i = 0;
    		key_serial_t serial;
    
    		serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
    				"leaked-keyring");
    		if (serial < 0) {
    			perror("keyctl");
    			return -1;
    		}
    
    		if (keyctl(KEYCTL_SETPERM, serial,
    			   KEY_POS_ALL | KEY_USR_ALL) < 0) {
    			perror("keyctl");
    			return -1;
    		}
    
    		for (i = 0; i < 100; i++) {
    			serial = keyctl(KEYCTL_JOIN_SESSION_KEYRING,
    					"leaked-keyring");
    			if (serial < 0) {
    				perror("keyctl");
    				return -1;
    			}
    		}
    
    		return 0;
    	}
    
    If, after the program has run, there something like the following line in
    /proc/keys:
    
    3f3d898f I--Q---   100 perm 3f3f0000     0     0 keyring   leaked-keyring: empty
    
    with a usage count of 100 * the number of times the program has been run,
    then the kernel is malfunctioning.  If leaked-keyring has zero usages or
    has been garbage collected, then the problem is fixed.
    
    Reported-by: Yevgeny Pats <yevgeny at perception-point.io>
    Signed-off-by: David Howells <dhowells at redhat.com>
    Acked-by: Don Zickus <dzickus at redhat.com>
    Acked-by: Prarit Bhargava <prarit at redhat.com>
    Acked-by: Jarod Wilson <jarod at redhat.com>
    Signed-off-by: James Morris <james.l.morris at oracle.com>
    Signed-off-by: Cyrill Gorcunov <gorcunov at openvz.org>
---
 security/keys/process_keys.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 0cf8a13..4e56371 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -793,6 +793,7 @@ long join_session_keyring(const char *name)
 		ret = PTR_ERR(keyring);
 		goto error2;
 	} else if (keyring == new->session_keyring) {
+		key_put(keyring);
 		ret = 0;
 		goto error2;
 	}