[PATCH v13 4/7] s390/cert_store: Read-lock keyring semaphore in invalidate_keyring_keys()

[Jarkko Sakkinen <jarkko@kernel.org>]

key_type->read() requires the caller to hold key->sem for reading.
Acquire keyring->sem across the two key_type_keyring.read() calls in
invalidate_keyring_keys() so the keyring cannot be modified between the
size query and the payload read.

Cc: David Howells <dhowells@redhat.com>
Cc: stable@vger.kernel.org # v6.6+
Fixes: 8cf57d7217c3 ("s390: add support for user-defined certificates")
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
---
 arch/s390/kernel/cert_store.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/arch/s390/kernel/cert_store.c b/arch/s390/kernel/cert_store.c
index bec95991edae..7d339fe2f6fc 100644
--- a/arch/s390/kernel/cert_store.c
+++ b/arch/s390/kernel/cert_store.c
@@ -319,13 +319,17 @@ static int invalidate_keyring_keys(struct key *keyring)
 	struct key *current_key;
 	int rc;
 
+	down_read(&keyring->sem);
 	keyring_payload_len = key_type_keyring.read(keyring, NULL, 0);
 	num_keys = keyring_payload_len / sizeof(key_serial_t);
 	key_array = kzalloc_objs(key_serial_t, num_keys);
-	if (!key_array)
+	if (!key_array) {
+		up_read(&keyring->sem);
 		return -ENOMEM;
+	}
 
 	rc = key_type_keyring.read(keyring, (char *)key_array, keyring_payload_len);
+	up_read(&keyring->sem);
 	if (rc != keyring_payload_len) {
 		pr_dbf_msg("Couldn't read keyring payload");
 		goto out;
-- 
2.47.3