KEYS: Fix __key_link_end() quota fixup on error

Fix __key_link_end()'s attempt to fix up the quota if an error occurs.

There are two erroneous cases: Firstly, we always decrease the quota if
the preallocated replacement keyring needs cleaning up, irrespective of
whether or not we should (we may have replaced a pointer rather than
adding another pointer).

Secondly, we never clean up the quota if we added a pointer without the
keyring storage being extended (we allocate multiple pointers at a time,
even if we're not going to use them all immediately).

We handle this by setting the bottom bit of the preallocation pointer in
__key_link_begin() to indicate that the quota needs fixing up, which is
then passed to __key_link() (which clears the whole thing) and
__key_link_end().

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

1 files changed, 4 insertions, 4 deletions

diff --git a/security/keys/key.c b/security/keys/key.c
index 84d4eb568b08..1c2d43dc5107 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -415,7 +415,7 @@ static int __key_instantiate_and_link(struct key *key,
                                       size_t datalen,
                                       struct key *keyring,
                                       struct key *authkey,
-                                      struct keyring_list **_prealloc)
+                                      unsigned long *_prealloc)
 {
         int ret, awaken;
 
@@ -481,7 +481,7 @@ int key_instantiate_and_link(struct key *key,
                              struct key *keyring,
                              struct key *authkey)
 {
-        struct keyring_list *prealloc;
+        unsigned long prealloc;
         int ret;
 
         if (keyring) {
@@ -526,7 +526,7 @@ int key_negate_and_link(struct key *key,
                         struct key *keyring,
                         struct key *authkey)
 {
-        struct keyring_list *prealloc;
+        unsigned long prealloc;
         struct timespec now;
         int ret, awaken, link_ret = 0;
 
@@ -814,7 +814,7 @@ key_ref_t key_create_or_update(key_ref_t keyring_ref,
                                key_perm_t perm,
                                unsigned long flags)
 {
-        struct keyring_list *prealloc;
+        unsigned long prealloc;
         const struct cred *cred = current_cred();
         struct key_type *ktype;
         struct key *keyring, *key = NULL;