From efde8b6e16f11e7d1681c68d86c7fd51053cada7 Mon Sep 17 00:00:00 2001 From: David Howells Date: Tue, 17 Jan 2012 20:39:40 +0000 Subject: KEYS: Add missing smp_rmb() primitives to the keyring search code Add missing smp_rmb() primitives to the keyring search code. When keyring payloads are appended to without replacement (thus using up spare slots in the key pointer array), an smp_wmb() is issued between the pointer assignment and the increment of the key count (nkeys). There should be corresponding read barriers between the read of nkeys and dereferences of keys[n] when n is dependent on the value of nkeys. Signed-off-by: David Howells Reviewed-by: Paul E. McKenney Signed-off-by: James Morris --- security/keys/gc.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'security/keys/gc.c') diff --git a/security/keys/gc.c b/security/keys/gc.c index bf4d8da5a795..a42b45531aac 100644 --- a/security/keys/gc.c +++ b/security/keys/gc.c @@ -145,7 +145,9 @@ static void key_gc_keyring(struct key *keyring, time_t limit) if (!klist) goto unlock_dont_gc; - for (loop = klist->nkeys - 1; loop >= 0; loop--) { + loop = klist->nkeys; + smp_rmb(); + for (loop--; loop >= 0; loop--) { key = klist->keys[loop]; if (test_bit(KEY_FLAG_DEAD, &key->flags) || (key->expiry > 0 && key->expiry <= limit)) -- cgit v1.2.3-59-g8ed1b