• Eric Biggers's avatar
    FS-Cache: fix dereference of NULL user_key_payload · d124b2c5
    Eric Biggers authored
    When the file /proc/fs/fscache/objects (available with
    CONFIG_FSCACHE_OBJECT_LIST=y) is opened, we request a user key with
    description "fscache:objlist", then access its payload.  However, a
    revoked key has a NULL payload, and we failed to check for this.
    request_key() *does* skip revoked keys, but there is still a window
    where the key can be revoked before we access its payload.
    Fix it by checking for a NULL payload, treating it like a key which was
    already revoked at the time it was requested.
    Fixes: 4fbf4291 ("FS-Cache: Allow the current state of all objects to be dumped")
    Reviewed-by: default avatarJames Morris <james.l.morris@oracle.com>
    Cc: <stable@vger.kernel.org>    [v2.6.32+]
    Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
    Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>