Bug#307553: CAN-2005-1368

2005-05-11 Thread Horms
reassign 307553 kernel-source-2.6.11
tag 307553 +pending
thanks

The fix for CAN-2005-1368 is in SVN for 2.6.11.
The code that this bug manifests in is not present
in 2.6.8 or 2.4.27.

-- 
Horms


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]



Bug#307553: CAN-2005-1368: DoS possibility through inproper SMP race handling in key_user_lookup()

2005-05-03 Thread Moritz Muehlenhoff
Package: kernel-source-2.6.8
Severity: important
Tags: security

<[EMAIL PROTECTED]>
[PATCH] Fix reproducible SMP crash in security/keys/key.c

Jani Jaakkola <[EMAIL PROTECTED]> wrote:
>
> SMP race handling is broken in key_user_lookup() in 
security/keys/key.c

This was fixed post-2.6.11.  Can you confirm that 2.6.12-rc2 works OK?

This is the patch we used.  It should go into -stable if it's not 
already
there.


From: Alexander Nyberg <[EMAIL PROTECTED]>

I looked at some of the oops reports against keyrings, I think the 
problem
is that the search isn't restarted after dropping the key_user_lock, *p
will still be NULL when we get back to try_again and look through the 
tree.

It looks like the intention was that the search start over from scratch.

Signed-off-by: Alexander Nyberg <[EMAIL PROTECTED]>
Cc: David Howells <[EMAIL PROTECTED]>
Signed-off-by: Andrew Morton <[EMAIL PROTECTED]>
Signed-off-by: Chris Wright <[EMAIL PROTECTED]>
Signed-off-by: Greg Kroah-Hartman <[EMAIL PROTECTED]>

The fix is part of the 2.6.11.8 series:
www.kernel.org/diff/diffview.cgi?file=%2Fpub%2Flinux%2Fkernel%2Fv2.6%2Fincr%2Fpatch-2.6.11.7-8.bz2;z=13

Cheers,
Moritz

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (500, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.11
Locale: LANG=C, [EMAIL PROTECTED] (charmap=ISO-8859-15)


-- 
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]