android_kernel_asus_sm8350/security
David Howells 97674f4cd0 keys: Do not cache key in task struct if key is requested from kernel thread
[ Upstream commit 47f9e4c924025c5be87959d3335e66fcbb7f6b5c ]

The key which gets cached in task structure from a kernel thread does not
get invalidated even after expiry.  Due to which, a new key request from
kernel thread will be served with the cached key if it's present in task
struct irrespective of the key validity.  The change is to not cache key in
task_struct when key requested from kernel thread so that kernel thread
gets a valid key on every key request.

The problem has been seen with the cifs module doing DNS lookups from a
kernel thread and the results getting pinned by being attached to that
kernel thread's cache - and thus not something that can be easily got rid
of.  The cache would ordinarily be cleared by notify-resume, but kernel
threads don't do that.

This isn't seen with AFS because AFS is doing request_key() within the
kernel half of a user thread - which will do notify-resume.

Fixes: 7743c48e54 ("keys: Cache result of request_key*() temporarily in task_struct")
Signed-off-by: Bharath SM <bharathsm@microsoft.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Reviewed-by: Jarkko Sakkinen <jarkko@kernel.org>
cc: Shyam Prasad N <nspmangalore@gmail.com>
cc: Steve French <smfrench@gmail.com>
cc: keyrings@vger.kernel.org
cc: linux-cifs@vger.kernel.org
cc: linux-fsdevel@vger.kernel.org
Link: https://lore.kernel.org/r/CAGypqWw951d=zYRbdgNR4snUDvJhWL=q3=WOyh7HhSJupjz2vA@mail.gmail.com/
Signed-off-by: Sasha Levin <sashal@kernel.org>
2023-04-05 11:16:37 +02:00
..
apparmor apparmor: Use pointer to struct aa_label for lbs_cred 2023-01-18 11:41:17 +01:00
integrity ima: Align ima_file_mmap() parameters with mmap_file LSM hook 2023-03-11 16:44:02 +01:00
keys keys: Do not cache key in task struct if key is requested from kernel thread 2023-04-05 11:16:37 +02:00
loadpin proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
lockdown lockdown: also lock down previous kgdb use 2022-06-06 08:33:48 +02:00
safesetid LSM: SafeSetID: Stop releasing uninitialized ruleset 2019-09-17 11:27:05 -07:00
selinux selinux: Add boundary check in put_entry() 2022-08-25 11:17:32 +02:00
smack Fix incorrect type in assignment of ipv6 port for audit 2022-04-15 14:18:22 +02:00
tomoyo tomoyo: fix broken dependency on *.conf.default 2023-02-06 07:52:35 +01:00
yama proc/sysctl: add shared variables for range check 2019-07-18 17:08:07 -07:00
commoncap.c capabilities: fix potential memleak on error path from vfs_getxattr_alloc() 2022-11-10 17:57:55 +01:00
device_cgroup.c device_cgroup: Roll back to original exceptions after copy failure 2023-01-18 11:41:50 +01:00
inode.c Merge branch 'work.mount0' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2019-07-19 10:42:02 -07:00
Kconfig fortify: Explicitly disable Clang support 2021-11-21 13:38:50 +01:00
Kconfig.hardening meminit fix 2019-07-28 12:33:15 -07:00
lsm_audit.c dump_common_audit_data(): fix racy accesses to ->d_name 2021-01-19 18:26:16 +01:00
Makefile security: Add a static lockdown policy LSM 2019-08-19 21:54:15 -07:00
min_addr.c License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
security.c ima: Align ima_file_mmap() parameters with mmap_file LSM hook 2023-03-11 16:44:02 +01:00