Commit 9d1ac65a authored by David Howells's avatar David Howells Committed by Linus Torvalds

KEYS: Fix RCU no-lock warning in keyctl_session_to_parent()

There's an protected access to the parent process's credentials in the middle
of keyctl_session_to_parent().  This results in the following RCU warning:

  ===================================================
  [ INFO: suspicious rcu_dereference_check() usage. ]
  ---------------------------------------------------
  security/keys/keyctl.c:1291 invoked rcu_dereference_check() without protection!

  other info that might help us debug this:

  rcu_scheduler_active = 1, debug_locks = 0
  1 lock held by keyctl-session-/2137:
   #0:  (tasklist_lock){.+.+..}, at: [<ffffffff811ae2ec>] keyctl_session_to_parent+0x60/0x236

  stack backtrace:
  Pid: 2137, comm: keyctl-session- Not tainted 2.6.36-rc2-cachefs+ #1
  Call Trace:
   [<ffffffff8105606a>] lockdep_rcu_dereference+0xaa/0xb3
   [<ffffffff811ae379>] keyctl_session_to_parent+0xed/0x236
   [<ffffffff811af77e>] sys_keyctl+0xb4/0xb6
   [<ffffffff81001eab>] system_call_fastpath+0x16/0x1b

The code should take the RCU read lock to make sure the parents credentials
don't go away, even though it's holding a spinlock and has IRQ disabled.
Signed-off-by: default avatarDavid Howells <dhowells@redhat.com>
Signed-off-by: default avatarLinus Torvalds <torvalds@linux-foundation.org>
parent ff3cb3fe
...@@ -1272,6 +1272,7 @@ long keyctl_session_to_parent(void) ...@@ -1272,6 +1272,7 @@ long keyctl_session_to_parent(void)
keyring_r = NULL; keyring_r = NULL;
me = current; me = current;
rcu_read_lock();
write_lock_irq(&tasklist_lock); write_lock_irq(&tasklist_lock);
parent = me->real_parent; parent = me->real_parent;
...@@ -1319,6 +1320,7 @@ long keyctl_session_to_parent(void) ...@@ -1319,6 +1320,7 @@ long keyctl_session_to_parent(void)
set_ti_thread_flag(task_thread_info(parent), TIF_NOTIFY_RESUME); set_ti_thread_flag(task_thread_info(parent), TIF_NOTIFY_RESUME);
write_unlock_irq(&tasklist_lock); write_unlock_irq(&tasklist_lock);
rcu_read_unlock();
if (oldcred) if (oldcred)
put_cred(oldcred); put_cred(oldcred);
return 0; return 0;
...@@ -1327,6 +1329,7 @@ long keyctl_session_to_parent(void) ...@@ -1327,6 +1329,7 @@ long keyctl_session_to_parent(void)
ret = 0; ret = 0;
not_permitted: not_permitted:
write_unlock_irq(&tasklist_lock); write_unlock_irq(&tasklist_lock);
rcu_read_unlock();
put_cred(cred); put_cred(cred);
return ret; return ret;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment