Commit cf8304e8 authored May 04, 2010 by David Howells Committed by James Morris May 05, 2010

KEYS: Fix RCU handling in key_gc_keyring()



key_gc_keyring() needs to either hold the RCU read lock or hold the keyring
semaphore if it's going to scan the keyring's list.  Given that it only needs
to read the key list, and it's doing so under a spinlock, the RCU read lock is
the thing to use.

Furthermore, the RCU check added in e7b0a61b is
incorrect as holding the spinlock on key_serial_lock is not grounds for
assuming a keyring's pointer list can be read safely.  Instead, a simple
rcu_dereference() inside of the previously mentioned RCU read lock is what we
want.

Reported-by: Serge E. Hallyn <serue@us.ibm.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Serge Hallyn <serue@us.ibm.com>
Acked-by: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Signed-off-by: James Morris <jmorris@namei.org>

parent d9a9b4ae

security/keys/gc.c

+6 −3

Original line number	Diff line number	Diff line
		@@ -77,10 +77,10 @@ static bool key_gc_keyring(struct key *keyring, time_t limit)
		goto dont_gc;

		/* scan the keyring looking for dead keys */
		klist = rcu_dereference_check(keyring->payload.subscriptions,
		lockdep_is_held(&key_serial_lock));
		rcu_read_lock();
		klist = rcu_dereference(keyring->payload.subscriptions);
		if (!klist)
		goto dont_gc;
		goto unlock_dont_gc;

		for (loop = klist->nkeys - 1; loop >= 0; loop--) {
		key = klist->keys[loop];
		@@ -89,11 +89,14 @@ static bool key_gc_keyring(struct key *keyring, time_t limit)
		goto do_gc;
		}

		unlock_dont_gc:
		rcu_read_unlock();
		dont_gc:
		kleave(" = false");
		return false;

		do_gc:
		rcu_read_unlock();
		key_gc_cursor = keyring->serial;
		key_get(keyring);
		spin_unlock(&key_serial_lock);

Admin message