提交 efde8b6e 编写于 作者: D David Howells 提交者: James Morris

KEYS: Add missing smp_rmb() primitives to the keyring search code

Add missing smp_rmb() primitives to the keyring search code.

When keyring payloads are appended to without replacement (thus using up spare
slots in the key pointer array), an smp_wmb() is issued between the pointer
assignment and the increment of the key count (nkeys).

There should be corresponding read barriers between the read of nkeys and
dereferences of keys[n] when n is dependent on the value of nkeys.
Signed-off-by: NDavid Howells <dhowells@redhat.com>
Reviewed-by: NPaul E. McKenney <paulmck@linux.vnet.ibm.com>
Signed-off-by: NJames Morris <jmorris@namei.org>
上级 25add8cf
...@@ -145,7 +145,9 @@ static void key_gc_keyring(struct key *keyring, time_t limit) ...@@ -145,7 +145,9 @@ static void key_gc_keyring(struct key *keyring, time_t limit)
if (!klist) if (!klist)
goto unlock_dont_gc; goto unlock_dont_gc;
for (loop = klist->nkeys - 1; loop >= 0; loop--) { loop = klist->nkeys;
smp_rmb();
for (loop--; loop >= 0; loop--) {
key = klist->keys[loop]; key = klist->keys[loop];
if (test_bit(KEY_FLAG_DEAD, &key->flags) || if (test_bit(KEY_FLAG_DEAD, &key->flags) ||
(key->expiry > 0 && key->expiry <= limit)) (key->expiry > 0 && key->expiry <= limit))
......
...@@ -319,7 +319,7 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, ...@@ -319,7 +319,7 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
struct key *keyring, *key; struct key *keyring, *key;
key_ref_t key_ref; key_ref_t key_ref;
long err; long err;
int sp, kix; int sp, nkeys, kix;
keyring = key_ref_to_ptr(keyring_ref); keyring = key_ref_to_ptr(keyring_ref);
possessed = is_key_possessed(keyring_ref); possessed = is_key_possessed(keyring_ref);
...@@ -380,7 +380,9 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, ...@@ -380,7 +380,9 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
goto not_this_keyring; goto not_this_keyring;
/* iterate through the keys in this keyring first */ /* iterate through the keys in this keyring first */
for (kix = 0; kix < keylist->nkeys; kix++) { nkeys = keylist->nkeys;
smp_rmb();
for (kix = 0; kix < nkeys; kix++) {
key = keylist->keys[kix]; key = keylist->keys[kix];
kflags = key->flags; kflags = key->flags;
...@@ -421,7 +423,9 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref, ...@@ -421,7 +423,9 @@ key_ref_t keyring_search_aux(key_ref_t keyring_ref,
/* search through the keyrings nested in this one */ /* search through the keyrings nested in this one */
kix = 0; kix = 0;
ascend: ascend:
for (; kix < keylist->nkeys; kix++) { nkeys = keylist->nkeys;
smp_rmb();
for (; kix < nkeys; kix++) {
key = keylist->keys[kix]; key = keylist->keys[kix];
if (key->type != &key_type_keyring) if (key->type != &key_type_keyring)
continue; continue;
...@@ -515,7 +519,7 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref, ...@@ -515,7 +519,7 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref,
struct keyring_list *klist; struct keyring_list *klist;
unsigned long possessed; unsigned long possessed;
struct key *keyring, *key; struct key *keyring, *key;
int loop; int nkeys, loop;
keyring = key_ref_to_ptr(keyring_ref); keyring = key_ref_to_ptr(keyring_ref);
possessed = is_key_possessed(keyring_ref); possessed = is_key_possessed(keyring_ref);
...@@ -524,7 +528,9 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref, ...@@ -524,7 +528,9 @@ key_ref_t __keyring_search_one(key_ref_t keyring_ref,
klist = rcu_dereference(keyring->payload.subscriptions); klist = rcu_dereference(keyring->payload.subscriptions);
if (klist) { if (klist) {
for (loop = 0; loop < klist->nkeys; loop++) { nkeys = klist->nkeys;
smp_rmb();
for (loop = 0; loop < nkeys ; loop++) {
key = klist->keys[loop]; key = klist->keys[loop];
if (key->type == ktype && if (key->type == ktype &&
...@@ -622,7 +628,7 @@ static int keyring_detect_cycle(struct key *A, struct key *B) ...@@ -622,7 +628,7 @@ static int keyring_detect_cycle(struct key *A, struct key *B)
struct keyring_list *keylist; struct keyring_list *keylist;
struct key *subtree, *key; struct key *subtree, *key;
int sp, kix, ret; int sp, nkeys, kix, ret;
rcu_read_lock(); rcu_read_lock();
...@@ -645,7 +651,9 @@ static int keyring_detect_cycle(struct key *A, struct key *B) ...@@ -645,7 +651,9 @@ static int keyring_detect_cycle(struct key *A, struct key *B)
ascend: ascend:
/* iterate through the remaining keys in this keyring */ /* iterate through the remaining keys in this keyring */
for (; kix < keylist->nkeys; kix++) { nkeys = keylist->nkeys;
smp_rmb();
for (; kix < nkeys; kix++) {
key = keylist->keys[kix]; key = keylist->keys[kix];
if (key == A) if (key == A)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册