Commit b59ec78cdcc57e02bc3dddfa7134a2f0fd15c34d

Authored by David Howells
Committed by James Morris
1 parent b91ce4d14a

keys: don't need to use RCU in keyring_read() as semaphore is held

keyring_read() doesn't need to use rcu_dereference() to access the keyring
payload as the caller holds the key semaphore to prevent modifications
from happening whilst the data is read out.

This should solve the following warning:

===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
security/keys/keyring.c:204 invoked rcu_dereference_check() without protection!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by keyctl/2144:
 #0:  (&key->sem){+++++.}, at: [<ffffffff81177f7c>] keyctl_read_key+0x9c/0xcf

stack backtrace:
Pid: 2144, comm: keyctl Not tainted 2.6.34-rc2-cachefs #113
Call Trace:
 [<ffffffff8105121f>] lockdep_rcu_dereference+0xaa/0xb2
 [<ffffffff811762d5>] keyring_read+0x4d/0xe7
 [<ffffffff81177f8c>] keyctl_read_key+0xac/0xcf
 [<ffffffff811788d4>] sys_keyctl+0x75/0xb9
 [<ffffffff81001eeb>] system_call_fastpath+0x16/0x1b

Signed-off-by: David Howells <dhowells@redhat.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: James Morris <jmorris@namei.org>

Showing 1 changed file with 1 additions and 1 deletions Side-by-side Diff

security/keys/keyring.c
... ... @@ -201,7 +201,7 @@
201 201 int loop, ret;
202 202  
203 203 ret = 0;
204   - klist = rcu_dereference(keyring->payload.subscriptions);
  204 + klist = keyring->payload.subscriptions;
205 205  
206 206 if (klist) {
207 207 /* calculate how much data we could return */