Hey David, On Fri, Apr 21, 2017 at 01:30:33AM -0700, Eric Biggers wrote: > From: Eric Biggers <ebigg...@google.com> > > Before returning from add_key() or one of the keyctl() commands that > takes in a key payload, zero the temporary buffer that was allocated to > hold the key payload copied from userspace. This may contain sensitive > key material that should not be kept around in the slab caches. > > This must not be applied before the patch "KEYS: fix dereferencing NULL > payload with nonzero length". > > Signed-off-by: Eric Biggers <ebigg...@google.com>
Can you make sure that my other patch "KEYS: fix dereferencing NULL payload with nonzero length" gets applied along with this one? Otherwise triggering the NULL pointer dereference (which really needs to be fixed anyway) becomes even more trivial. The only reason I didn't check for NULL before doing the memsets is that the bug was going to have to be fixed anyway, and the fix backported. - Eric
