2 files changed, 9 insertions, 2 deletions

diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index e814d2109f8e..dd7cd0f8e13c 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -201,7 +201,7 @@ static long keyring_read(const struct key *keyring,
         int loop, ret;
 
         ret = 0;
-        klist = rcu_dereference(keyring->payload.subscriptions);
+        klist = keyring->payload.subscriptions;
 
         if (klist) {
                 /* calculate how much data we could return */
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index ea97c3120d66..d737cea5347c 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -339,8 +339,10 @@ static int construct_alloc_key(struct key_type *type,
 
 key_already_present:
         mutex_unlock(&key_construction_mutex);
-        if (dest_keyring)
+        if (dest_keyring) {
+                __key_link(dest_keyring, key_ref_to_ptr(key_ref));
                 up_write(&dest_keyring->sem);
+        }
         mutex_unlock(&user->cons_lock);
         key_put(key);
         *_key = key = key_ref_to_ptr(key_ref);
@@ -431,6 +433,11 @@ struct key *request_key_and_link(struct key_type *type,
 
         if (!IS_ERR(key_ref)) {
                 key = key_ref_to_ptr(key_ref);
+                if (dest_keyring) {
+                        construct_get_dest_keyring(&dest_keyring);
+                        key_link(dest_keyring, key);
+                        key_put(dest_keyring);
+                }
         } else if (PTR_ERR(key_ref) != -EAGAIN) {
                 key = ERR_CAST(key_ref);
         } else  {