1. 09 1月, 2015 7 次提交
  2. 08 1月, 2015 1 次提交
    • P
      assoc_array: Include rcupdate.h for call_rcu() definition · 990428b8
      Pranith Kumar 提交于
      Include rcupdate.h header to provide call_rcu() definition. This was implicitly
      being provided by slab.h file which include srcu.h somewhere in its include
      hierarchy which in-turn included rcupdate.h.
      
      Lately, tinification effort added support to remove srcu entirely because of
      which we are encountering build errors like
      
      lib/assoc_array.c: In function 'assoc_array_apply_edit':
      lib/assoc_array.c:1426:2: error: implicit declaration of function 'call_rcu' [-Werror=implicit-function-declaration]
      cc1: some warnings being treated as errors
      
      Fix these by including rcupdate.h explicitly.
      Signed-off-by: NPranith Kumar <bobby.prani@gmail.com>
      Reported-by: NScott Wood <scottwood@freescale.com>
      990428b8
  3. 07 1月, 2015 14 次提交
  4. 06 1月, 2015 17 次提交
  5. 05 1月, 2015 1 次提交
    • S
      KEYS: close race between key lookup and freeing · a3a87844
      Sasha Levin 提交于
      When a key is being garbage collected, it's key->user would get put before
      the ->destroy() callback is called, where the key is removed from it's
      respective tracking structures.
      
      This leaves a key hanging in a semi-invalid state which leaves a window open
      for a different task to try an access key->user. An example is
      find_keyring_by_name() which would dereference key->user for a key that is
      in the process of being garbage collected (where key->user was freed but
      ->destroy() wasn't called yet - so it's still present in the linked list).
      
      This would cause either a panic, or corrupt memory.
      
      Fixes CVE-2014-9529.
      Signed-off-by: NSasha Levin <sasha.levin@oracle.com>
      Signed-off-by: NDavid Howells <dhowells@redhat.com>
      a3a87844