linux-kernel.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: "Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
To: linux-kernel@vger.kernel.org
Cc: mingo@elte.hu, laijs@cn.fujitsu.com, dipankar@in.ibm.com,
	akpm@linux-foundation.org, mathieu.desnoyers@polymtl.ca,
	josh@joshtriplett.org, dvhltc@us.ibm.com, niv@us.ibm.com,
	tglx@linutronix.de, peterz@infradead.org, rostedt@goodmis.org,
	Valdis.Kletnieks@vt.edu, dhowells@redhat.com,
	eric.dumazet@gmail.com,
	"Paul E. McKenney" <paulmck@linux.vnet.ibm.com>
Subject: [PATCH tip/core/urgent 03/10] KEYS: Fix an RCU warning in the reading of user keys
Date: Fri, 30 Apr 2010 17:26:07 -0700	[thread overview]
Message-ID: <1272673574-27797-3-git-send-email-paulmck@linux.vnet.ibm.com> (raw)
In-Reply-To: <20100501002548.GA27375@linux.vnet.ibm.com>

From: David Howells <dhowells@redhat.com>

Fix an RCU warning in the reading of user keys:

===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
security/keys/user_defined.c:202 invoked rcu_dereference_check() without protection!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by keyctl/3637:
 #0:  (&key->sem){+++++.}, at: [<ffffffff811a80ae>] keyctl_read_key+0x9c/0xcf

stack backtrace:
Pid: 3637, comm: keyctl Not tainted 2.6.34-rc5-cachefs #18
Call Trace:
 [<ffffffff81051f6c>] lockdep_rcu_dereference+0xaa/0xb2
 [<ffffffff811aa55f>] user_read+0x47/0x91
 [<ffffffff811a80be>] keyctl_read_key+0xac/0xcf
 [<ffffffff811a8a06>] sys_keyctl+0x75/0xb7
 [<ffffffff81001eeb>] system_call_fastpath+0x16/0x1b

Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
---
 security/keys/user_defined.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 7c687d5..e9aa079 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -199,7 +199,8 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
 	struct user_key_payload *upayload;
 	long ret;
 
-	upayload = rcu_dereference(key->payload.data);
+	upayload = rcu_dereference_protected(
+		key->payload.data, rwsem_is_locked(&((struct key *)key)->sem));
 	ret = upayload->datalen;
 
 	/* we can return the data as is */
-- 
1.7.0


  parent reply	other threads:[~2010-05-01  0:26 UTC|newest]

Thread overview: 12+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2010-05-01  0:25 [PATCH tip/core/urgent 0/10] v2: Fix RCU lockdep splats Paul E. McKenney
2010-05-01  0:26 ` [PATCH tip/core/urgent 01/10] rcu: v2: optionally leave lockdep enabled after RCU lockdep splat Paul E. McKenney
2010-05-01  0:26 ` [PATCH tip/core/urgent 02/10] KEYS: Fix an RCU warning Paul E. McKenney
2010-05-01  0:26 ` Paul E. McKenney [this message]
2010-05-01  0:26 ` [PATCH tip/core/urgent 04/10] cgroup: Fix an RCU warning in cgroup_path() Paul E. McKenney
2010-05-01  0:26 ` [PATCH tip/core/urgent 05/10] cgroup: Fix an RCU warning in alloc_css_id() Paul E. McKenney
2010-05-01  0:26 ` [PATCH tip/core/urgent 06/10] sched: Fix an RCU warning in print_task() Paul E. McKenney
2010-05-01  0:26 ` [PATCH tip/core/urgent 07/10] cgroup: Check task_lock in task_subsys_state() Paul E. McKenney
2010-05-01  0:26 ` [PATCH tip/core/urgent 08/10] memcg: css_id() must be called under rcu_read_lock() Paul E. McKenney
2010-05-01  0:26 ` [PATCH tip/core/urgent 09/10] blk-cgroup: Fix RCU correctness warning in cfq_init_queue() Paul E. McKenney
2010-05-01  0:26 ` [PATCH tip/core/urgent 10/10] vfs: fix RCU-lockdep false positive due to /proc access Paul E. McKenney
  -- strict thread matches above, loose matches on Subject: below --
2010-05-03 18:52 [PATCH tip/core/urgent 0/10] v3: Fix RCU lockdep splats Paul E. McKenney
2010-05-03 18:53 ` [PATCH tip/core/urgent 03/10] KEYS: Fix an RCU warning in the reading of user keys Paul E. McKenney

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1272673574-27797-3-git-send-email-paulmck@linux.vnet.ibm.com \
    --to=paulmck@linux.vnet.ibm.com \
    --cc=Valdis.Kletnieks@vt.edu \
    --cc=akpm@linux-foundation.org \
    --cc=dhowells@redhat.com \
    --cc=dipankar@in.ibm.com \
    --cc=dvhltc@us.ibm.com \
    --cc=eric.dumazet@gmail.com \
    --cc=josh@joshtriplett.org \
    --cc=laijs@cn.fujitsu.com \
    --cc=linux-kernel@vger.kernel.org \
    --cc=mathieu.desnoyers@polymtl.ca \
    --cc=mingo@elte.hu \
    --cc=niv@us.ibm.com \
    --cc=peterz@infradead.org \
    --cc=rostedt@goodmis.org \
    --cc=tglx@linutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).