Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9d6c8711 authored by Eric Biggers's avatar Eric Biggers Committed by David Howells
Browse files

KEYS: Load key expiry time atomically in keyring_search_iterator() 



Similar to the case for key_validate(), we should load the key ->expiry
once atomically in keyring_search_iterator(), since it can be changed
concurrently with the flags whenever the key semaphore isn't held.

Signed-off-by: default avatarEric Biggers <ebiggers@google.com>
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
parent 1823d475

security/keys/keyring.c

+3 −1
Original line number Diff line number Diff line
@@ -566,6 +566,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data) 


	/* skip invalidated, revoked and expired keys */

	if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {

		time_t expiry = READ_ONCE(key->expiry);



		if (kflags & ((1 << KEY_FLAG_INVALIDATED) |

			      (1 << KEY_FLAG_REVOKED))) {

			ctx->result = ERR_PTR(-EKEYREVOKED);
@@ -573,7 +575,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data) 
			goto skipped;

		}



		if (key->expiry && ctx->now.tv_sec >= key->expiry) {

		if (expiry && ctx->now.tv_sec >= expiry) {

			if (!(ctx->flags & KEYRING_SEARCH_SKIP_EXPIRED))

				ctx->result = ERR_PTR(-EKEYEXPIRED);

			kleave(" = %d [expire]", ctx->skipped_ret);