5 files changed, 49 insertions, 32 deletions

diff --git a/security/inode.c b/security/inode.c
index c3a793881d04..1c812e874504 100644
--- a/security/inode.c
+++ b/security/inode.c
@@ -161,13 +161,13 @@ static int create_by_name(const char *name, mode_t mode,
 
         mutex_lock(&parent->d_inode->i_mutex);
         *dentry = lookup_one_len(name, parent, strlen(name));
-        if (!IS_ERR(dentry)) {
+        if (!IS_ERR(*dentry)) {
                 if ((mode & S_IFMT) == S_IFDIR)
                         error = mkdir(parent->d_inode, *dentry, mode);
                 else
                         error = create(parent->d_inode, *dentry, mode);
         } else
-                error = PTR_ERR(dentry);
+                error = PTR_ERR(*dentry);
         mutex_unlock(&parent->d_inode->i_mutex);
 
         return error;
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 19902319d097..a46e825cbf02 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -77,10 +77,10 @@ static bool key_gc_keyring(struct key *keyring, time_t limit)
                 goto dont_gc;
 
         /* scan the keyring looking for dead keys */
-        klist = rcu_dereference_check(keyring->payload.subscriptions,
-                                      lockdep_is_held(&key_serial_lock));
+        rcu_read_lock();
+        klist = rcu_dereference(keyring->payload.subscriptions);
         if (!klist)
-                goto dont_gc;
+                goto unlock_dont_gc;
 
         for (loop = klist->nkeys - 1; loop >= 0; loop--) {
                 key = klist->keys[loop];
@@ -89,11 +89,14 @@ static bool key_gc_keyring(struct key *keyring, time_t limit)
                         goto do_gc;
         }
 
+unlock_dont_gc:
+        rcu_read_unlock();
 dont_gc:
         kleave(" = false");
         return false;
 
 do_gc:
+        rcu_read_unlock();
         key_gc_cursor = keyring->serial;
         key_get(keyring);
         spin_unlock(&key_serial_lock);
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index e814d2109f8e..1e4b0037935c 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -20,6 +20,11 @@
 #include <asm/uaccess.h>
 #include "internal.h"
 
+#define rcu_dereference_locked_keyring(keyring)                         \
+        (rcu_dereference_protected(                                     \
+                (keyring)->payload.subscriptions,                       \
+                rwsem_is_locked((struct rw_semaphore *)&(keyring)->sem)))
+
 /*
  * when plumbing the depths of the key tree, this sets a hard limit set on how
  * deep we're willing to go
@@ -201,8 +206,7 @@ static long keyring_read(const struct key *keyring,
         int loop, ret;
 
         ret = 0;
-        klist = rcu_dereference(keyring->payload.subscriptions);
-
+        klist = rcu_dereference_locked_keyring(keyring);
         if (klist) {
                 /* calculate how much data we could return */
                 qty = klist->nkeys * sizeof(key_serial_t);
@@ -526,9 +530,8 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
         struct key *keyring;
         int bucket;
 
-        keyring = ERR_PTR(-EINVAL);
         if (!name)
-                goto error;
+                return ERR_PTR(-EINVAL);
 
         bucket = keyring_hash(name);
 
@@ -555,17 +558,18 @@ struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
                                            KEY_SEARCH) < 0)
                                 continue;
 
-                        /* we've got a match */
-                        atomic_inc(&keyring->usage);
-                        read_unlock(&keyring_name_lock);
-                        goto error;
+                        /* we've got a match but we might end up racing with
+                         * key_cleanup() if the keyring is currently 'dead'
+                         * (ie. it has a zero usage count) */
+                        if (!atomic_inc_not_zero(&keyring->usage))
+                                continue;
+                        goto out;
                 }
         }
 
-        read_unlock(&keyring_name_lock);
         keyring = ERR_PTR(-ENOKEY);
-
- error:
+out:
+        read_unlock(&keyring_name_lock);
         return keyring;
 
 } /* end find_keyring_by_name() */
@@ -720,8 +724,7 @@ int __key_link(struct key *keyring, struct key *key)
         }
 
         /* see if there's a matching key we can displace */
-        klist = keyring->payload.subscriptions;
-
+        klist = rcu_dereference_locked_keyring(keyring);
         if (klist && klist->nkeys > 0) {
                 struct key_type *type = key->type;
 
@@ -765,8 +768,6 @@ int __key_link(struct key *keyring, struct key *key)
         if (ret < 0)
                 goto error2;
 
-        klist = keyring->payload.subscriptions;
-
         if (klist && klist->nkeys < klist->maxkeys) {
                 /* there's sufficient slack space to add directly */
                 atomic_inc(&key->usage);
@@ -868,7 +869,7 @@ int key_unlink(struct key *keyring, struct key *key)
 
         down_write(&keyring->sem);
 
-        klist = keyring->payload.subscriptions;
+        klist = rcu_dereference_locked_keyring(keyring);
         if (klist) {
                 /* search the keyring for the key */
                 for (loop = 0; loop < klist->nkeys; loop++)
@@ -959,7 +960,7 @@ int keyring_clear(struct key *keyring)
                 /* detach the pointer block with the locks held */
                 down_write(&keyring->sem);
 
-                klist = keyring->payload.subscriptions;
+                klist = rcu_dereference_locked_keyring(keyring);
                 if (klist) {
                         /* adjust the quota */
                         key_payload_reserve(keyring,
@@ -991,7 +992,9 @@ EXPORT_SYMBOL(keyring_clear);
  */
 static void keyring_revoke(struct key *keyring)
 {
-        struct keyring_list *klist = keyring->payload.subscriptions;
+        struct keyring_list *klist;
+
+        klist = rcu_dereference_locked_keyring(keyring);
 
         /* adjust the quota */
         key_payload_reserve(keyring, 0);
@@ -1025,7 +1028,7 @@ void keyring_gc(struct key *keyring, time_t limit)
 
         down_write(&keyring->sem);
 
-        klist = keyring->payload.subscriptions;
+        klist = rcu_dereference_locked_keyring(keyring);
         if (!klist)
                 goto no_klist;
 
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 03fe63ed55bd..d8c1a6a0fb08 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -68,7 +68,8 @@ static int call_sbin_request_key(struct key_construction *cons,
 {
         const struct cred *cred = current_cred();
         key_serial_t prkey, sskey;
-        struct key *key = cons->key, *authkey = cons->authkey, *keyring;
+        struct key *key = cons->key, *authkey = cons->authkey, *keyring,
+                *session;
         char *argv[9], *envp[3], uid_str[12], gid_str[12];
         char key_str[12], keyring_str[3][12];
         char desc[20];
@@ -93,7 +94,7 @@ static int call_sbin_request_key(struct key_construction *cons,
         }
 
         /* attach the auth key to the session keyring */
-        ret = __key_link(keyring, authkey);
+        ret = key_link(keyring, authkey);
         if (ret < 0)
                 goto error_link;
 
@@ -112,10 +113,12 @@ static int call_sbin_request_key(struct key_construction *cons,
         if (cred->tgcred->process_keyring)
                 prkey = cred->tgcred->process_keyring->serial;
 
-        if (cred->tgcred->session_keyring)
-                sskey = rcu_dereference(cred->tgcred->session_keyring)->serial;
-        else
-                sskey = cred->user->session_keyring->serial;
+        rcu_read_lock();
+        session = rcu_dereference(cred->tgcred->session_keyring);
+        if (!session)
+                session = cred->user->session_keyring;
+        sskey = session->serial;
+        rcu_read_unlock();
 
         sprintf(keyring_str[2], "%d", sskey);
 
@@ -336,8 +339,10 @@ static int construct_alloc_key(struct key_type *type,
 
 key_already_present:
         mutex_unlock(&key_construction_mutex);
-        if (dest_keyring)
+        if (dest_keyring) {
+                __key_link(dest_keyring, key_ref_to_ptr(key_ref));
                 up_write(&dest_keyring->sem);
+        }
         mutex_unlock(&user->cons_lock);
         key_put(key);
         *_key = key = key_ref_to_ptr(key_ref);
@@ -428,6 +433,11 @@ struct key *request_key_and_link(struct key_type *type,
 
         if (!IS_ERR(key_ref)) {
                 key = key_ref_to_ptr(key_ref);
+                if (dest_keyring) {
+                        construct_get_dest_keyring(&dest_keyring);
+                        key_link(dest_keyring, key);
+                        key_put(dest_keyring);
+                }
         } else if (PTR_ERR(key_ref) != -EAGAIN) {
                 key = ERR_CAST(key_ref);
         } else  {
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 7c687d568221..e9aa07929656 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -199,7 +199,8 @@ long user_read(const struct key *key, char __user *buffer, size_t buflen)
         struct user_key_payload *upayload;
         long ret;
 
-        upayload = rcu_dereference(key->payload.data);
+        upayload = rcu_dereference_protected(
+                key->payload.data, rwsem_is_locked(&((struct key *)key)->sem));
         ret = upayload->datalen;
 
         /* we can return the data as is */