From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752041AbdI0TvU (ORCPT ); Wed, 27 Sep 2017 15:51:20 -0400 Received: from mail-pf0-f195.google.com ([209.85.192.195]:32942 "EHLO mail-pf0-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751136AbdI0TvR (ORCPT ); Wed, 27 Sep 2017 15:51:17 -0400 X-Google-Smtp-Source: AOwi7QAt9r4kzqv7b11DvlUJhpuBXBH22S97dD1VfkyP0pIKKmeM13jT/WsIXrbJ9JwndZabeBYm1Q== From: Eric Biggers To: keyrings@vger.kernel.org Cc: David Howells , Michael Halcrow , linux-security-module@vger.kernel.org, linux-kernel@vger.kernel.org, Eric Biggers Subject: [PATCH v3 5/7] KEYS: load key flags and expiry time atomically in keyring_search_iterator() Date: Wed, 27 Sep 2017 12:50:45 -0700 Message-Id: <20170927195047.122358-6-ebiggers3@gmail.com> X-Mailer: git-send-email 2.14.2.822.g60be5d43e6-goog In-Reply-To: <20170927195047.122358-1-ebiggers3@gmail.com> References: <20170927195047.122358-1-ebiggers3@gmail.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Eric Biggers Similar to the case for key_validate(), we should load the key ->flags and ->expiry once atomically in keyring_search_iterator(), since they can be changed concurrently whenever the key semaphore isn't held. Signed-off-by: Eric Biggers --- security/keys/keyring.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/security/keys/keyring.c b/security/keys/keyring.c index e54ad0ed7aa4..cb39b517f69c 100644 --- a/security/keys/keyring.c +++ b/security/keys/keyring.c @@ -553,7 +553,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data) { struct keyring_search_context *ctx = iterator_data; const struct key *key = keyring_ptr_to_key(object); - unsigned long kflags = key->flags; + unsigned long kflags = READ_ONCE(key->flags); kenter("{%d}", key->serial); @@ -565,6 +565,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data) /* skip invalidated, revoked and expired keys */ if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) { + time_t expiry = READ_ONCE(key->expiry); + if (kflags & ((1 << KEY_FLAG_INVALIDATED) | (1 << KEY_FLAG_REVOKED))) { ctx->result = ERR_PTR(-EKEYREVOKED); @@ -572,7 +574,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data) goto skipped; } - if (key->expiry && ctx->now.tv_sec >= key->expiry) { + if (expiry && ctx->now.tv_sec >= expiry) { if (!(ctx->flags & KEYRING_SEARCH_SKIP_EXPIRED)) ctx->result = ERR_PTR(-EKEYEXPIRED); kleave(" = %d [expire]", ctx->skipped_ret); -- 2.14.2.822.g60be5d43e6-goog