rufimelo/DeltaSecommits huggingface dataset:
Vulnerability: The __skb_recv_datagram function in net/core/datagram.c in the Linux kernel before 3.8 does not properly handle the MSG_PEEK flag with zero-length data, which allows local users to cause a denial of service (infinite loop and system hang) via a crafted application.
Vulnerability ID: CVE-2013-0290
CWE: CWE-20
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-02-19
File: net/core/datagram.c
Commit message: net: fix infinite loop in __skb_recv_datagram()

Tommi was fuzzing with trinity and reported the following problem :

commit 3f518bf745 (datagram: Add offset argument to __skb_recv_datagram)
missed that a raw socket receive queue can contain skbs with no payload.

We can loop in __skb_recv_datagram() with MSG_PEEK mode, because
wait_for_packet() is not prepared to skip these skbs.

[   83.541011] INFO: rcu_sched detected stalls on CPUs/tasks: {}
(detected by 0, t=26002 jiffies, g=27673, c=27672, q=75)
[   83.541011] INFO: Stall ended before state dump start
[  108.067010] BUG: soft lockup - CPU#0 stuck for 22s! [trinity-child31:2847]
...
[  108.067010] Call Trace:
[  108.067010]  [<ffffffff818cc103>] __skb_recv_datagram+0x1a3/0x3b0
[  108.067010]  [<ffffffff818cc33d>] skb_recv_datagram+0x2d/0x30
[  108.067010]  [<ffffffff819ed43d>] rawv6_recvmsg+0xad/0x240
[  108.067010]  [<ffffffff818c4b04>] sock_common_recvmsg+0x34/0x50
[  108.067010]  [<ffffffff818bc8ec>] sock_recvmsg+0xbc/0xf0
[  108.067010]  [<ffffffff818bf31e>] sys_recvfrom+0xde/0x150
[  108.067010]  [<ffffffff81ca4329>] system_call_fastpath+0x16/0x1b

Reported-by: Tommi Rantala <tt.rantala@gmail.com>
Tested-by: Tommi Rantala <tt.rantala@gmail.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Pavel Emelyanov <xemul@parallels.com>
Acked-by: Pavel Emelyanov <xemul@parallels.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Eric Dumazet

Vulnerable version (before fix):
 struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, 		skb_queue_walk(queue, skb) { 			*peeked = skb->peeked; 			if (flags & MSG_PEEK) { 				if (*off >= skb->len) { 					*off -= skb->len; 					continue; 				}

Fixed version (after fix):
 struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags, 		skb_queue_walk(queue, skb) { 			*peeked = skb->peeked; 			if (flags & MSG_PEEK) { 				if (*off >= skb->len && skb->len) { 					*off -= skb->len; 					continue; 				}

Patch:
patch: @@ -187,7 +187,7 @@ struct sk_buff *__skb_recv_datagram(struct sock *sk, unsigned int flags,
 		skb_queue_walk(queue, skb) {
 			*peeked = skb->peeked;
 			if (flags & MSG_PEEK) {
-				if (*off >= skb->len) {
+				if (*off >= skb->len && skb->len) {
 					*off -= skb->len;
 					continue;
 				}
path: net/core/datagram.c
Vulnerability: The hidp_setup_hid function in net/bluetooth/hidp/core.c in the Linux kernel before 3.7.6 does not properly copy a certain name field, which allows local users to obtain sensitive information from kernel memory by setting a long name and making an HIDPCONNADD ioctl call.
Vulnerability ID: CVE-2013-0349
CWE: CWE-200
Severity score: 2.9
Project: https://github.com/torvalds/linux
Published: 2013-02-28
File: net/bluetooth/hidp/core.c
Commit message: Bluetooth: Fix incorrect strncpy() in hidp_setup_hid()

The length parameter should be sizeof(req->name) - 1 because there is no
guarantee that string provided by userspace will contain the trailing
'\0'.

Can be easily reproduced by manually setting req->name to 128 non-zero
bytes prior to ioctl(HIDPCONNADD) and checking the device name setup on
input subsystem:

$ cat /sys/devices/pnp0/00\:04/tty/ttyS0/hci0/hci0\:1/input8/name
AAAAAA[...]AAAAAAAAf0:af:f0:af:f0:af

("f0:af:f0:af:f0:af" is the device bluetooth address, taken from "phys"
field in struct hid_device due to overflow.)

Cc: stable@vger.kernel.org
Signed-off-by: Anderson Lizardo <anderson.lizardo@openbossa.org>
Acked-by: Marcel Holtmann <marcel@holtmann.org>
Signed-off-by: Gustavo Padovan <gustavo.padovan@collabora.co.uk>
Commit author: Anderson Lizardo

Vulnerable version (before fix):
 static int hidp_setup_hid(struct hidp_session *session, 	hid->version = req->version; 	hid->country = req->country;  	strncpy(hid->name, req->name, 128);  	snprintf(hid->phys, sizeof(hid->phys), "%pMR", 		 &bt_sk(session->ctrl_sock->sk)->src);

Fixed version (after fix):
 static int hidp_setup_hid(struct hidp_session *session, 	hid->version = req->version; 	hid->country = req->country;  	strncpy(hid->name, req->name, sizeof(req->name) - 1);  	snprintf(hid->phys, sizeof(hid->phys), "%pMR", 		 &bt_sk(session->ctrl_sock->sk)->src);

Patch:
patch: @@ -931,7 +931,7 @@ static int hidp_setup_hid(struct hidp_session *session,
 	hid->version = req->version;
 	hid->country = req->country;
 
-	strncpy(hid->name, req->name, 128);
+	strncpy(hid->name, req->name, sizeof(req->name) - 1);
 
 	snprintf(hid->phys, sizeof(hid->phys), "%pMR",
 		 &bt_sk(session->ctrl_sock->sk)->src);
path: net/bluetooth/hidp/core.c
Vulnerability: Cross-site scripting (XSS) vulnerability in the NewSectionPrompt function in include/tool/editing_page.php in gpEasy CMS 3.5.2 and earlier allows remote attackers to inject arbitrary web script or HTML via the section parameter in a new_section action to index.php.
Vulnerability ID: CVE-2013-0807
CWE: CWE-79
Severity score: 2.9
Project: https://github.com/oyejorge/gpEasy-CMS
Published: 2014-03-28
File: include/tool/editing_page.php
Commit message: new_section vulnerability fixed
Commit author: Josh Schmidt

Vulnerable version (before fix):
 static function GetDefaultContent($type){ 	function NewSectionPrompt(){ 		global $langmessage;   		ob_start(); 		echo '<div class="inline_box">'; 		echo '<form method="post" action="'.common::GetUrl($this->title).'">'; function NewSectionPrompt(){  		echo '<p>'; 		echo '<input type="hidden" name="last_mod" value="'.$this->fileModTime.'" />'; 		echo '<input type="hidden" name="section" value="'.$_GET['section'].'" />'; 		echo '<input type="hidden" name="cmd" value="add_section" />'; 		echo '<input type="submit" name="" value="'.$langmessage['save'].'" class="gpsubmit"/>'; 		echo ' <input type="button" name="" value="'.$langmessage['cancel'].'" class="admin_box_close gpcancel" />';

Fixed version (after fix):
 static function GetDefaultContent($type){ 	function NewSectionPrompt(){ 		global $langmessage;  		ob_start(); 		echo '<div class="inline_box">'; 		echo '<form method="post" action="'.common::GetUrl($this->title).'">'; function NewSectionPrompt(){  		echo '<p>'; 		echo '<input type="hidden" name="last_mod" value="'.$this->fileModTime.'" />'; 		echo '<input type="hidden" name="section" value="'.htmlspecialchars($_GET['section']).'" />'; 		echo '<input type="hidden" name="cmd" value="add_section" />'; 		echo '<input type="submit" name="" value="'.$langmessage['save'].'" class="gpsubmit"/>'; 		echo ' <input type="button" name="" value="'.$langmessage['cancel'].'" class="admin_box_close gpcancel" />';

Patch:
patch: @@ -451,7 +451,6 @@ static function GetDefaultContent($type){
 	function NewSectionPrompt(){
 		global $langmessage;
 
-
 		ob_start();
 		echo '<div class="inline_box">';
 		echo '<form method="post" action="'.common::GetUrl($this->title).'">';
@@ -481,7 +480,7 @@ function NewSectionPrompt(){
 
 		echo '<p>';
 		echo '<input type="hidden" name="last_mod" value="'.$this->fileModTime.'" />';
-		echo '<input type="hidden" name="section" value="'.$_GET['section'].'" />';
+		echo '<input type="hidden" name="section" value="'.htmlspecialchars($_GET['section']).'" />';
 		echo '<input type="hidden" name="cmd" value="add_section" />';
 		echo '<input type="submit" name="" value="'.$langmessage['save'].'" class="gpsubmit"/>';
 		echo ' <input type="button" name="" value="'.$langmessage['cancel'].'" class="admin_box_close gpcancel" />';
path: include/tool/editing_page.php
Vulnerability: The flush_signal_handlers function in kernel/signal.c in the Linux kernel before 3.8.4 preserves the value of the sa_restorer field across an exec operation, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application containing a sigaction system call.
Vulnerability ID: CVE-2013-0914
CWE: CWE-264
Severity score: 4.9
Project: https://github.com/torvalds/linux
Published: 2013-03-22
File: kernel/signal.c
Commit message: signal: always clear sa_restorer on execve

When the new signal handlers are set up, the location of sa_restorer is
not cleared, leaking a parent process's address space location to
children.  This allows for a potential bypass of the parent's ASLR by
examining the sa_restorer value returned when calling sigaction().

Based on what should be considered "secret" about addresses, it only
matters across the exec not the fork (since the VMAs haven't changed
until the exec).  But since exec sets SIG_DFL and keeps sa_restorer,
this is where it should be fixed.

Given the few uses of sa_restorer, a "set" function was not written
since this would be the only use.  Instead, we use
__ARCH_HAS_SA_RESTORER, as already done in other places.

Example of the leak before applying this patch:

  $ cat /proc/$$/maps
  ...
  7fb9f3083000-7fb9f3238000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  $ ./leak
  ...
  7f278bc74000-7f278be29000 r-xp 00000000 fd:01 404469 .../libc-2.15.so
  ...
  1 0 (nil) 0x7fb9f30b94a0
  2 4000000 (nil) 0x7f278bcaa4a0
  3 4000000 (nil) 0x7f278bcaa4a0
  4 0 (nil) 0x7fb9f30b94a0
  ...

[akpm@linux-foundation.org: use SA_RESTORER for backportability]
Signed-off-by: Kees Cook <keescook@chromium.org>
Reported-by: Emese Revfy <re.emese@gmail.com>
Cc: Emese Revfy <re.emese@gmail.com>
Cc: PaX Team <pageexec@freemail.hu>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Cc: Oleg Nesterov <oleg@redhat.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Serge Hallyn <serge.hallyn@canonical.com>
Cc: Julien Tinnes <jln@google.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Commit author: Kees Cook

Vulnerable version (before fix):
 flush_signal_handlers(struct task_struct *t, int force_default) 		if (force_default || ka->sa.sa_handler != SIG_IGN) 			ka->sa.sa_handler = SIG_DFL; 		ka->sa.sa_flags = 0; 		sigemptyset(&ka->sa.sa_mask); 		ka++; 	}

Fixed version (after fix):
 flush_signal_handlers(struct task_struct *t, int force_default) 		if (force_default || ka->sa.sa_handler != SIG_IGN) 			ka->sa.sa_handler = SIG_DFL; 		ka->sa.sa_flags = 0; #ifdef SA_RESTORER 		ka->sa.sa_restorer = NULL; #endif 		sigemptyset(&ka->sa.sa_mask); 		ka++; 	}

Patch:
patch: @@ -485,6 +485,9 @@ flush_signal_handlers(struct task_struct *t, int force_default)
 		if (force_default || ka->sa.sa_handler != SIG_IGN)
 			ka->sa.sa_handler = SIG_DFL;
 		ka->sa.sa_flags = 0;
+#ifdef SA_RESTORER
+		ka->sa.sa_restorer = NULL;
+#endif
 		sigemptyset(&ka->sa.sa_mask);
 		ka++;
 	}
path: kernel/signal.c
Vulnerability: The pkinit_check_kdc_pkid function in plugins/preauth/pkinit/pkinit_crypto_openssl.c in the PKINIT implementation in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.4 and 1.11.x before 1.11.1 does not properly handle errors during extraction of fields from an X.509 certificate, which allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a malformed KRB5_PADATA_PK_AS_REQ AS-REQ request.
Vulnerability ID: CVE-2013-1415
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/krb5/krb5
Published: 2013-03-05
File: src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
Commit message: PKINIT null pointer deref [CVE-2013-1415]

Don't dereference a null pointer when cleaning up.

The KDC plugin for PKINIT can dereference a null pointer when a
malformed packet causes processing to terminate early, leading to
a crash of the KDC process.  An attacker would need to have a valid
PKINIT certificate or have observed a successful PKINIT authentication,
or an unauthenticated attacker could execute the attack if anonymous
PKINIT is enabled.

CVSSv2 vector: AV:N/AC:M/Au:N/C:N/I:N/A:C/E:P/RL:O/RC:C

This is a minimal commit for pullup; style fixes in a followup.
[kaduk@mit.edu: reformat and edit commit message]

(cherry picked from commit c773d3c775e9b2d88bcdff5f8a8ba88d7ec4e8ed)

ticket: 7570
version_fixed: 1.11.1
status: resolved
Commit author: Xi Wang

Vulnerable version (before fix):
 pkinit_check_kdc_pkid(krb5_context context,     pkiDebug("found kdcPkId in AS REQ\n");     is = d2i_PKCS7_ISSUER_AND_SERIAL(NULL, &p, (int)pkid_len);     if (is == NULL)         goto cleanup;      status = X509_NAME_cmp(X509_get_issuer_name(kdc_cert), is->issuer);     if (!status) { pkinit_check_kdc_pkid(krb5_context context,     }      retval = 0; cleanup:     X509_NAME_free(is->issuer);     ASN1_INTEGER_free(is->serial);     free(is);

Fixed version (after fix):
 pkinit_check_kdc_pkid(krb5_context context,     pkiDebug("found kdcPkId in AS REQ\n");     is = d2i_PKCS7_ISSUER_AND_SERIAL(NULL, &p, (int)pkid_len);     if (is == NULL)         return retval;      status = X509_NAME_cmp(X509_get_issuer_name(kdc_cert), is->issuer);     if (!status) { pkinit_check_kdc_pkid(krb5_context context,     }      retval = 0;     X509_NAME_free(is->issuer);     ASN1_INTEGER_free(is->serial);     free(is);

Patch:
patch: @@ -3253,7 +3253,7 @@ pkinit_check_kdc_pkid(krb5_context context,
     pkiDebug("found kdcPkId in AS REQ\n");
     is = d2i_PKCS7_ISSUER_AND_SERIAL(NULL, &p, (int)pkid_len);
     if (is == NULL)
-        goto cleanup;
+        return retval;
 
     status = X509_NAME_cmp(X509_get_issuer_name(kdc_cert), is->issuer);
     if (!status) {
@@ -3263,7 +3263,6 @@ pkinit_check_kdc_pkid(krb5_context context,
     }
 
     retval = 0;
-cleanup:
     X509_NAME_free(is->issuer);
     ASN1_INTEGER_free(is->serial);
     free(is);
path: src/plugins/preauth/pkinit/pkinit_crypto_openssl.c
Vulnerability: The setup_server_realm function in main.c in the Key Distribution Center (KDC) in MIT Kerberos 5 (aka krb5) before 1.10.7, when multiple realms are configured, allows remote attackers to cause a denial of service (NULL pointer dereference and daemon crash) via a crafted request.
Vulnerability ID: CVE-2013-1418
CWE: CWE-476
Severity score: 2.9
Project: https://github.com/krb5/krb5
Published: 2013-11-18
File: src/kdc/main.c
Commit message: Multi-realm KDC null deref [CVE-2013-1418]

If a KDC serves multiple realms, certain requests can cause
setup_server_realm() to dereference a null pointer, crashing the KDC.

CVSSv2: AV:N/AC:M/Au:N/C:N/I:N/A:P/E:POC/RL:OF/RC:C

A related but more minor vulnerability requires authentication to
exploit, and is only present if a third-party KDC database module can
dereference a null pointer under certain conditions.

(back ported from commit 5d2d9a1abe46a2c1a8614d4672d08d9d30a5f8bf)

ticket: 7757 (new)
version_fixed: 1.10.7
status: resolved
Commit author: Tom Yu

Vulnerable version (before fix):
 setup_server_realm(krb5_principal sprinc)     kdc_realm_t         *newrealm;      kret = 0;     if (kdc_numrealms > 1) {         if (!(newrealm = find_realm_data(sprinc->realm.data,                                          (krb5_ui_4) sprinc->realm.length)))

Fixed version (after fix):
 setup_server_realm(krb5_principal sprinc)     kdc_realm_t         *newrealm;      kret = 0;     if (sprinc == NULL)         return NULL;      if (kdc_numrealms > 1) {         if (!(newrealm = find_realm_data(sprinc->realm.data,                                          (krb5_ui_4) sprinc->realm.length)))

Patch:
patch: @@ -140,6 +140,9 @@ setup_server_realm(krb5_principal sprinc)
     kdc_realm_t         *newrealm;
 
     kret = 0;
+    if (sprinc == NULL)
+        return NULL;
+
     if (kdc_numrealms > 1) {
         if (!(newrealm = find_realm_data(sprinc->realm.data,
                                          (krb5_ui_4) sprinc->realm.length)))
path: src/kdc/main.c
Vulnerability: Stack-based buffer overflow in the receive_tcppacket function in net_packet.c in tinc before 1.0.21 and 1.1 before 1.1pre7 allows remote authenticated peers to cause a denial of service (crash) or possibly execute arbitrary code via a large TCP packet.
Vulnerability ID: CVE-2013-1428
CWE: CWE-119
Severity score: 6.4
Project: https://github.com/gsliepen/tinc
Published: 2013-04-26
File: src/net_packet.c
Commit message: Drop packets forwarded via TCP if they are too big (CVE-2013-1428).

Normally all requests sent via the meta connections are checked so that they
cannot be larger than the input buffer. However, when packets are forwarded via
meta connections, they are copied into a packet buffer without checking whether
it fits into it. Since the packet buffer is allocated on the stack, this in
effect allows an authenticated remote node to cause a stack overflow.

This issue was found by Martin Schobert.
Commit author: Guus Sliepen

Vulnerable version (before fix):
 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) { void receive_tcppacket(connection_t *c, const char *buffer, int len) { 	vpn_packet_t outpkt;  	outpkt.len = len; 	if(c->options & OPTION_TCPONLY) 		outpkt.priority = 0;

Fixed version (after fix):
 static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) { void receive_tcppacket(connection_t *c, const char *buffer, int len) { 	vpn_packet_t outpkt;  	if(len > sizeof outpkt.data) 		return;  	outpkt.len = len; 	if(c->options & OPTION_TCPONLY) 		outpkt.priority = 0;

Patch:
patch: @@ -394,6 +394,9 @@ static void receive_udppacket(node_t *n, vpn_packet_t *inpkt) {
 void receive_tcppacket(connection_t *c, const char *buffer, int len) {
 	vpn_packet_t outpkt;
 
+	if(len > sizeof outpkt.data)
+		return;
+
 	outpkt.len = len;
 	if(c->options & OPTION_TCPONLY)
 		outpkt.priority = 0;
path: src/net_packet.c
Vulnerability: Array index error in the __sock_diag_rcv_msg function in net/core/sock_diag.c in the Linux kernel before 3.7.10 allows local users to gain privileges via a large family value in a Netlink message.
Vulnerability ID: CVE-2013-1763
CWE: CWE-20
Severity score: 10
Project: https://github.com/torvalds/linux
Published: 2013-02-28
File: net/core/sock_diag.c
Commit message: sock_diag: Fix out-of-bounds access to sock_diag_handlers[]

Userland can send a netlink message requesting SOCK_DIAG_BY_FAMILY
with a family greater or equal then AF_MAX -- the array size of
sock_diag_handlers[]. The current code does not test for this
condition therefore is vulnerable to an out-of-bound access opening
doors for a privilege escalation.

Signed-off-by: Mathias Krause <minipli@googlemail.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Commit author: Mathias Krause

Vulnerable version (before fix):
 static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 	if (nlmsg_len(nlh) < sizeof(*req)) 		return -EINVAL;  	hndl = sock_diag_lock_handler(req->sdiag_family); 	if (hndl == NULL) 		err = -ENOENT;

Fixed version (after fix):
 static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh) 	if (nlmsg_len(nlh) < sizeof(*req)) 		return -EINVAL;  	if (req->sdiag_family >= AF_MAX) 		return -EINVAL;  	hndl = sock_diag_lock_handler(req->sdiag_family); 	if (hndl == NULL) 		err = -ENOENT;

Patch:
patch: @@ -121,6 +121,9 @@ static int __sock_diag_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
 	if (nlmsg_len(nlh) < sizeof(*req))
 		return -EINVAL;
 
+	if (req->sdiag_family >= AF_MAX)
+		return -EINVAL;
+
 	hndl = sock_diag_lock_handler(req->sdiag_family);
 	if (hndl == NULL)
 		err = -ENOENT;
path: net/core/sock_diag.c
Vulnerability: Race condition in the install_user_keyrings function in security/keys/process_keys.c in the Linux kernel before 3.8.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) via crafted keyctl system calls that trigger keyring operations in simultaneous threads.
Vulnerability ID: CVE-2013-1792
CWE: CWE-362
Severity score: 6.9
Project: https://github.com/torvalds/linux
Published: 2013-03-22
File: security/keys/process_keys.c
Commit message: keys: fix race with concurrent install_user_keyrings()

This fixes CVE-2013-1792.

There is a race in install_user_keyrings() that can cause a NULL pointer
dereference when called concurrently for the same user if the uid and
uid-session keyrings are not yet created.  It might be possible for an
unprivileged user to trigger this by calling keyctl() from userspace in
parallel immediately after logging in.

Assume that we have two threads both executing lookup_user_key(), both
looking for KEY_SPEC_USER_SESSION_KEYRING.

	THREAD A			THREAD B
	===============================	===============================
					==>call install_user_keyrings();
	if (!cred->user->session_keyring)
	==>call install_user_keyrings()
					...
					user->uid_keyring = uid_keyring;
	if (user->uid_keyring)
		return 0;
	<==
	key = cred->user->session_keyring [== NULL]
					user->session_keyring = session_keyring;
	atomic_inc(&key->usage); [oops]

At the point thread A dereferences cred->user->session_keyring, thread B
hasn't updated user->session_keyring yet, but thread A assumes it is
populated because install_user_keyrings() returned ok.

The race window is really small but can be exploited if, for example,
thread B is interrupted or preempted after initializing uid_keyring, but
before doing setting session_keyring.

This couldn't be reproduced on a stock kernel.  However, after placing
systemtap probe on 'user->session_keyring = session_keyring;' that
introduced some delay, the kernel could be crashed reliably.

Fix this by checking both pointers before deciding whether to return.
Alternatively, the test could be done away with entirely as it is checked
inside the mutex - but since the mutex is global, that may not be the best
way.

Signed-off-by: David Howells <dhowells@redhat.com>
Reported-by: Mateusz Guzik <mguzik@redhat.com>
Cc: <stable@kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Morris <james.l.morris@oracle.com>
Commit author: David Howells

Vulnerable version (before fix):
 int install_user_keyrings(void)  	kenter("%p{%u}", user, uid);  	if (user->uid_keyring) { 		kleave(" = 0 [exist]"); 		return 0; 	}

Fixed version (after fix):
 int install_user_keyrings(void)  	kenter("%p{%u}", user, uid);  	if (user->uid_keyring && user->session_keyring) { 		kleave(" = 0 [exist]"); 		return 0; 	}

Patch:
patch: @@ -57,7 +57,7 @@ int install_user_keyrings(void)
 
 	kenter("%p{%u}", user, uid);
 
-	if (user->uid_keyring) {
+	if (user->uid_keyring && user->session_keyring) {
 		kleave(" = 0 [exist]");
 		return 0;
 	}
path: security/keys/process_keys.c