From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1032055AbdIZUOn (ORCPT ); Tue, 26 Sep 2017 16:14:43 -0400 Received: from mail-pg0-f68.google.com ([74.125.83.68]:35080 "EHLO mail-pg0-f68.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S968766AbdIZUOc (ORCPT ); Tue, 26 Sep 2017 16:14:32 -0400 X-Google-Smtp-Source: AOwi7QCXHghlBMxW2oDjE47r1g6Ho6RYcF5lDAVsjWNfDEFiBHFTbDiXjDmAXRsglb3CO2qZgwQCjw== From: Eric Biggers To: keyrings@vger.kernel.org Cc: David Howells , Michael Halcrow , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Biggers Subject: [PATCH v2 4/6] KEYS: load key flags and expiry time atomically in keyring_search_iterator() Date: Tue, 26 Sep 2017 13:11:03 -0700 Message-Id: <20170926201105.126166-5-ebiggers3@gmail.com> X-Mailer: git-send-email 2.14.1.992.g2c7b836f3a-goog In-Reply-To: <20170926201105.126166-1-ebiggers3@gmail.com> References: <20170926201105.126166-1-ebiggers3@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Biggers Similar to the case for key_validate(), we should load the key ->flags and ->expiry once atomically in keyring_search_iterator(), since they can be changed concurrently whenever the key semaphore isn't held. Signed-off-by: Eric Biggers --- security/keys/keyring.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/security/keys/keyring.c b/security/keys/keyring.c index 7fc661f492d3..1dfff0eac474 100644 --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -553,7 +553,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data) { struct keyring_search_context *ctx = iterator_data; const struct key *key = keyring_ptr_to_key(object); - unsigned long kflags = key->flags; + unsigned long kflags = READ_ONCE(key->flags); kenter("{%d}", key->serial); @@ -565,6 +565,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data) /* skip invalidated, revoked and expired keys */ if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) { + time_t expiry = READ_ONCE(key->expiry); + if (kflags & ((1 << KEY_FLAG_INVALIDATED) | (1 << KEY_FLAG_REVOKED))) { ctx->result = ERR_PTR(-EKEYREVOKED); @@ -572,7 +574,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data) goto skipped; } - if (key->expiry && ctx->now.tv_sec >= key->expiry) { + if (expiry && ctx->now.tv_sec >= expiry) { if (!(ctx->flags & KEYRING_SEARCH_SKIP_EXPIRED)) ctx->result = ERR_PTR(-EKEYEXPIRED); kleave(" = %d [expire]", ctx->skipped_ret); -- 2.14.1.992.g2c7b836f3a-goog