Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit efde8b6e authored by David Howells's avatar David Howells Committed by James Morris
Browse files

KEYS: Add missing smp_rmb() primitives to the keyring search code 



Add missing smp_rmb() primitives to the keyring search code.

When keyring payloads are appended to without replacement (thus using up spare
slots in the key pointer array), an smp_wmb() is issued between the pointer
assignment and the increment of the key count (nkeys).

There should be corresponding read barriers between the read of nkeys and
dereferences of keys[n] when n is dependent on the value of nkeys.

Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Reviewed-by: default avatarPaul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: default avatarJames Morris <jmorris@namei.org>
parent 25add8cf

security/keys/gc.c

+3 −1
Original line number Diff line number Diff line
@@ -145,7 +145,9 @@ static void key_gc_keyring(struct key *keyring, time_t limit) 
	if (!klist)

		goto unlock_dont_gc;



	for (loop = klist->nkeys - 1; loop >= 0; loop--) {

	loop = klist->nkeys;

	smp_rmb();

	for (loop--; loop >= 0; loop--) {

		key = klist->keys[loop];

		if (test_bit(KEY_FLAG_DEAD, &key->flags) ||

		    (key->expiry > 0 && key->expiry <= limit))

security/keys/keyring.c

+15 −7
Original line number Diff line number Diff line
@@ -319,7 +319,7 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, 
	struct key *keyring, *key;

	key_ref_t key_ref;

	long err;

	int sp, kix;

	int sp, nkeys, kix;



	keyring = key_ref_to_ptr(keyring_ref);

	possessed = is_key_possessed(keyring_ref);
@@ -380,7 +380,9 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, 
		goto not_this_keyring;



	/* iterate through the keys in this keyring first */

	for (kix = 0; kix < keylist->nkeys; kix++) {

	nkeys = keylist->nkeys;

	smp_rmb();

	for (kix = 0; kix < nkeys; kix++) {

		key = keylist->keys[kix];

		kflags = key->flags;
@@ -421,7 +423,9 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, 
	/* search through the keyrings nested in this one */

	kix = 0;

ascend:

	for (; kix < keylist->nkeys; kix++) {

	nkeys = keylist->nkeys;

	smp_rmb();

	for (; kix < nkeys; kix++) {

		key = keylist->keys[kix];

		if (key->type != &key_type_keyring)

			continue;
@@ -515,7 +519,7 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref, 
	struct keyring_list *klist;

	unsigned long possessed;

	struct key *keyring, *key;

	int loop;

	int nkeys, loop;



	keyring = key_ref_to_ptr(keyring_ref);

	possessed = is_key_possessed(keyring_ref);
@@ -524,7 +528,9 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref, 


	klist = rcu_dereference(keyring->payload.subscriptions);

	if (klist) {

		for (loop = 0; loop < klist->nkeys; loop++) {

		nkeys = klist->nkeys;

		smp_rmb();

		for (loop = 0; loop < nkeys ; loop++) {

			key = klist->keys[loop];



			if (key->type == ktype &&
@@ -622,7 +628,7 @@ static int keyring_detect_cycle(struct key *A, struct key *B) 


	struct keyring_list *keylist;

	struct key *subtree, *key;

	int sp, kix, ret;

	int sp, nkeys, kix, ret;



	rcu_read_lock();
@@ -645,7 +651,9 @@ static int keyring_detect_cycle(struct key *A, struct key *B) 


ascend:

	/* iterate through the remaining keys in this keyring */

	for (; kix < keylist->nkeys; kix++) {

	nkeys = keylist->nkeys;

	smp_rmb();

	for (; kix < nkeys; kix++) {

		key = keylist->keys[kix];



		if (key == A)