lkml.org 
[lkml]   [2006]   [Apr]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
Subject[RFC] install_session_keyring
Hello,
In a study of the control flow graph dumps to check that
an rcu_assign_pointer() with a given argument type has
preceded a call to rcu_dereference(), I've come across
install_session_keyring() of security/keys/process_keys.c.
We note that although no rcu_read_lock() is in place
locally or in the function's kernel callers, siglock
likely addresses that. While the rcu_dereference() would
indicate a desire for 'old' to persist, synchronize_rcu()
is called prior to key_put(old) which "disposes of
reference to a key." The order of events with a use of
the copy of the pointer following synchronize_rcu() is
what I question.

Thanks.
Suzanne

/******************************************************/
/*
* install a session keyring, discarding the old one
* - if a keyring is not supplied, an empty one is invented
*/
static int install_session_keyring(struct task_struct *tsk,
struct key *keyring)
{
unsigned long flags;
struct key *old;
char buf[20];
int ret;

/* create an empty session keyring */
if (!keyring) {
sprintf(buf, "_ses.%u", tsk->tgid);

keyring = keyring_alloc(buf, tsk->uid, tsk->gid, 1, NULL);
if (IS_ERR(keyring)) {
ret = PTR_ERR(keyring);
goto error;
}
}
else {
atomic_inc(&keyring->usage);
}

/* install the keyring */
spin_lock_irqsave(&tsk->sighand->siglock, flags);
old = rcu_dereference(tsk->signal->session_keyring);
rcu_assign_pointer(tsk->signal->session_keyring, keyring);
spin_unlock_irqrestore(&tsk->sighand->siglock, flags);

ret = 0;

/* we're using RCU on the pointer */
synchronize_rcu();
key_put(old);
error:
return ret;

} /* end install_session_keyring() */

-
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/

\
 
 \ /
  Last update: 2006-04-03 14:40    [W:0.044 / U:0.116 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site