Prev: net: show stopped status in sysfs
Next: power: fix block_io.c printk warning
From: Serge E. Hallyn on 3 May 2010 18:10
Quoting David Howells (dhowells(a)redhat.com):
> Fix an RCU warning in the reading of user keys:
>
> ===================================================
> [ INFO: suspicious rcu_dereference_check() usage. ]
> ---------------------------------------------------
> security/keys/user_defined.c:202 invoked rcu_dereference_check() without protection!
>
> other info that might help us debug this:
>
>
> rcu_scheduler_active = 1, debug_locks = 0
> 1 lock held by keyctl/3637:
> #0: (&key->sem){+++++.}, at: [<ffffffff811a80ae>] keyctl_read_key+0x9c/0xcf
>
> stack backtrace:
> Pid: 3637, comm: keyctl Not tainted 2.6.34-rc5-cachefs #18
> Call Trace:
> [<ffffffff81051f6c>] lockdep_rcu_dereference+0xaa/0xb2
> [<ffffffff811aa55f>] user_read+0x47/0x91
> [<ffffffff811a80be>] keyctl_read_key+0xac/0xcf
> [<ffffffff811a8a06>] sys_keyctl+0x75/0xb7
> [<ffffffff81001eeb>] system_call_fastpath+0x16/0x1b
>
> Signed-off-by: David Howells <dhowells(a)redhat.com>

heck it also serves to document it a bit, as looking at the fn
itself it's not clear that it is called under key->sem.

Acked-by: Serge Hallyn <serue(a)us.ibm.com>

> ---
>
> security/keys/user_defined.c | 3 ++-
> 1 files changed, 2 insertions(+), 1 deletions(-)
>
> diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
> index 7c687d5..e9aa079 100644
> --- a/security/keys/user_defined.c
> +++ b/security/keys/user_defined.c
> @@ -199,7 +199,8 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
> struct user_key_payload *upayload;
> long ret;
>
> - upayload = rcu_dereference(key->payload.data);
> + upayload = rcu_dereference_protected(
> + key->payload.data, rwsem_is_locked(&((struct key *)key)->sem));
> ret = upayload->datalen;
>
> /* we can return the data as is */
>
> --
> To unsubscribe from this list: send the line "unsubscribe linux-security-module" in
> the body of a message to majordomo(a)vger.kernel.org
> More majordomo info at http://vger.kernel.org/majordomo-info.html
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: James Morris on 5 May 2010 22:50
Okay... patches 1-4 have gone into -linus, along with 'KEYS: Fix RCU
handling in key_gc_keyring()'

The should probably all be in -stable (see the most recent 'keys' patches
in -linus).

Patches 5 & 6 are in:
git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/security-testing-2.6#next

The final patch does not apply to my tree -- please rebase it.


- James
--
James Morris
<jmorris(a)namei.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: James Morris on 6 May 2010 08:30
On Thu, 6 May 2010, David Howells wrote:

> James Morris <jmorris(a)namei.org> wrote:
>
> > The final patch does not apply to my tree -- please rebase it.
>
> Your tree is not up to date with respect to Linus's: you're missing the three
> patches he pulled in yesterday.

Ok, I forgot to pull from Linus' tree before merging locally, looks fine
now.

--
James Morris
<jmorris(a)namei.org>
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: net: show stopped status in sysfs
Next: power: fix block_io.c printk warning