Re: [Linux-stable-mirror] [PATCH] KEYS: add missing permission check for request_key() destination

On Tue, Nov 28, 2017 at 10:13:01AM +0000, David Howells wrote:

Eric Biggers ebiggers3@gmail.com wrote:

...

• if (do_perm_check) {
  

• 	ret = key_permission(make_key_ref(dest_keyring, 1),
  

• 			     KEY_NEED_WRITE);
  

dest_keyring may be NULL at this point as alloc_uid() doesn't automatically create keyrings.

David

Argh, you're right. I must have been confused by the calls to key_serial(), key_put(), etc., but those all check for NULL. I'll send a revised patch.

Eric