CVE-2015-7872: Input Validation

A vulnerability in the Linux kernel's keyrings garbage collector allowing any local user account to trigger a kernel panic.

Problem arrises when using requestkey() or keyctl request2.

This code sequence tries to invoke an upcall to instantiate a keyring if one doesn't already exist by that name within the user's keyring set. However, if the upcall fails, the code sets keyring->typedata.rejecterror to -ENOKEY or some other error code. When the key is garbage collected, the key destroy function is called unconditionally and keyringdestroy() uses listempty() on keyring->typedata.link - which is in a union with rejecterror. Subsequently, the kernel tries to unlink the keyring from the keyring names list, which leads to an oops.