The commit is pushed to "branch-rh8-4.18.0-193.6.3.vz8.4.x-ovz" and will appear
at https://src.openvz.org/scm/ovz/vzkernel.git
after rh8-4.18.0-193.6.3.vz8.4.7
------>
commit aa398a57928328c8be2bf3fd19da9f734bb5e0f4
Author: Andrey Ryabinin <aryabi...@virtuozzo.com>
Date: Wed Sep 23 15:55:59 2020 +0300
keys,user: fix NULL-ptr dereference in user_destroy() #PSBM-108198
key->payload.data could be NULL
BUG: unable to handle kernel NULL pointer dereference at 0000000000000010
IP: user_destroy+0x13/0x30
Call Trace:
key_gc_unused_keys.constprop.1+0xfd/0x110
key_garbage_collector+0x1d7/0x390
process_one_work+0x185/0x440
worker_thread+0x126/0x3c0
kthread+0xd1/0xe0
ret_from_fork_nospec_begin+0x7/0x21
Add the necessary check to fix this.
https://jira.sw.ru/browse/PSBM-108198
Signed-off-by: Andrey Ryabinin <aryabi...@virtuozzo.com>
Fixes: d77ff0bac744 ("keys, user: Fix high order allocation in
user_instantiate()")
(cherry picked from commit a0e271fd8929312b1c5dab72fbc8bc336a296b45)
Signed-off-by: Konstantin Khorenko <khore...@virtuozzo.com>
---
security/keys/user_defined.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 39add3cd78ef..54a4e0a48cf2 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -156,8 +156,10 @@ void user_destroy(struct key *key)
{
struct user_key_payload *upayload = key->payload.data[0];
- memset(upayload, 0, sizeof(*upayload) + upayload->datalen);
- kvfree(upayload);
+ if (upayload) {
+ memset(upayload, 0, sizeof(*upayload) + upayload->datalen);
+ kvfree(upayload);
+ }
}
EXPORT_SYMBOL_GPL(user_destroy);
_______________________________________________
Devel mailing list
Devel@openvz.org
https://lists.openvz.org/mailman/listinfo/devel
