CVE-2016-4470 Patch information

Question

Patch for CVE

The description states :

The key_reject_and_link function in security/keys/key.c in the Linux kernel through 4.6.3 does not ensure that a certain data structure is initialized, which allows local users to cause a denial of service (system crash) via vectors involving a crafted keyctl request2 command.

Questions:

1. Looking at the patch, how do the variables fix the bug?
2. Does it involve race condition? Explanation would be extremely helpful, as I am new in C
3. How exactly does this patch prevent a DOS condition

Answer 1

1. Since the root cause of this CVE is that __key_link_begin fails, and variable edit is uninitialized, the method to fix this problem is to detect such failure of __key_link_begin. From my knowledge, link_ret is the return value of __key_link_begin(), the patch adds one condition ( link_ret == 0 ) to verify whether __key_link_begin fails or not.

2. I think it should not involve race condition here. My guess is from the stack trace shown in the patch

3. Please refer to the answer of Question 1.