lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Tue, 19 Sep 2017 16:46:08 +0100
From:   David Howells <>
To:     Eric Biggers <>
        Michael Halcrow <>,,, Eric Biggers <>
Subject: Re: [PATCH] KEYS: fix cred refcount leak in request_key_auth_new()

Eric Biggers <> wrote:

> In request_key_auth_new(), if alloc_key() or key_instantiate_and_link()
> were to fail, we would leak a reference to the 'struct cred'.  Currently
> this can only happen if alloc_key() fails to to allocate memory.  But it
> still should be fixed, as it is a more severe bug waiting to happen.

It might be better to combine request_key_auth_destroy() and the error path
that you're altering in request_key_auth_new() by pulling it into a separate


Powered by blists - more mailing lists