[PATCH] keys: Fix UAF in key_put()

David Howells dhowells at redhat.com
Tue Mar 18 13:27:54 UTC 2025


Oleg Nesterov <oleg at redhat.com> wrote:

> and since key_user_put() takes key_user_lock with irqs enabled,
> key_put()->key_user_put() doesn't look correct...

Meh.  Yeah.  I think it's time to do it the other way (i.e. putting keys to be
destroyed onto an explicit cleanup queue).

David




More information about the Linux-security-module-archive mailing list