1 files changed, 8 insertions, 6 deletions

diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 4fa82a8a9c0e..a7e51f793867 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -414,7 +414,7 @@ static void keyring_describe(const struct key *keyring, struct seq_file *m)
         else
                 seq_puts(m, "[anon]");
 
-        if (key_is_instantiated(keyring)) {
+        if (key_is_positive(keyring)) {
                 if (keyring->keys.nr_leaves_on_tree != 0)
                         seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree);
                 else
@@ -553,7 +553,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
 {
         struct keyring_search_context *ctx = iterator_data;
         const struct key *key = keyring_ptr_to_key(object);
-        unsigned long kflags = key->flags;
+        unsigned long kflags = READ_ONCE(key->flags);
+        short state = READ_ONCE(key->state);
 
         kenter("{%d}", key->serial);
 
@@ -565,6 +566,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
 
         /* skip invalidated, revoked and expired keys */
         if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
+                time_t expiry = READ_ONCE(key->expiry);
+
                 if (kflags & ((1 << KEY_FLAG_INVALIDATED) |
                               (1 << KEY_FLAG_REVOKED))) {
                         ctx->result = ERR_PTR(-EKEYREVOKED);
@@ -572,7 +575,7 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
                         goto skipped;
                 }
 
-                if (key->expiry && ctx->now.tv_sec >= key->expiry) {
+                if (expiry && ctx->now.tv_sec >= expiry) {
                         if (!(ctx->flags & KEYRING_SEARCH_SKIP_EXPIRED))
                                 ctx->result = ERR_PTR(-EKEYEXPIRED);
                         kleave(" = %d [expire]", ctx->skipped_ret);
@@ -597,9 +600,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
 
         if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
                 /* we set a different error code if we pass a negative key */
-                if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
-                        smp_rmb();
-                        ctx->result = ERR_PTR(key->reject_error);
+                if (state < 0) {
+                        ctx->result = ERR_PTR(state);
                         kleave(" = %d [neg]", ctx->skipped_ret);
                         goto skipped;
                 }