diff options
| author |   David Howells <dhowells@redhat.com> | 2010-04-21 17:36:35 +0100 |
|---|---|---|
| committer |   Paul E. McKenney <paulmck@linux.vnet.ibm.com> | 2010-05-04 09:24:58 -0700 |
| commit | e35ec2d2c1fc45dd3e46dde74bb0c4c4366125bf (patch) | |
| tree | d5df7afffd9b258617fcd53b00a6eee790c1b831 /security/keys/user_defined.c | |
| parent | KEYS: Fix an RCU warning (diff) | |
| download | linux-dev-e35ec2d2c1fc45dd3e46dde74bb0c4c4366125bf.tar.xz linux-dev-e35ec2d2c1fc45dd3e46dde74bb0c4c4366125bf.zip | |
KEYS: Fix an RCU warning in the reading of user keys
Fix an RCU warning in the reading of user keys:
===================================================
[ INFO: suspicious rcu_dereference_check() usage. ]
---------------------------------------------------
security/keys/user_defined.c:202 invoked rcu_dereference_check() without protection!
other info that might help us debug this:
rcu_scheduler_active = 1, debug_locks = 0
1 lock held by keyctl/3637:
#0: (&key->sem){+++++.}, at: [<ffffffff811a80ae>] keyctl_read_key+0x9c/0xcf
stack backtrace:
Pid: 3637, comm: keyctl Not tainted 2.6.34-rc5-cachefs #18
Call Trace:
[<ffffffff81051f6c>] lockdep_rcu_dereference+0xaa/0xb2
[<ffffffff811aa55f>] user_read+0x47/0x91
[<ffffffff811a80be>] keyctl_read_key+0xac/0xcf
[<ffffffff811a8a06>] sys_keyctl+0x75/0xb7
[<ffffffff81001eeb>] system_call_fastpath+0x16/0x1b
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
Diffstat (limited to '')
| -rw-r--r-- | security/keys/user_defined.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c index 7c687d568221..e9aa07929656 100644 --- a/security/keys/user_defined.c +++ b/security/keys/user_defined.c @@ -199,7 +199,8 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen) struct user_key_payload *upayload; long ret; - upayload = rcu_dereference(key->payload.data); + upayload = rcu_dereference_protected( + key->payload.data, rwsem_is_locked(&((struct key *)key)->sem)); ret = upayload->datalen; /* we can return the data as is */ |