2 files changed, 5 insertions, 2 deletions

diff --git a/security/keys/gc.c b/security/keys/gc.c
index 4770be375ffe..19902319d097 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -77,7 +77,8 @@ static bool key_gc_keyring(struct key *keyring, time_t limit)
                 goto dont_gc;
 
         /* scan the keyring looking for dead keys */
-        klist = rcu_dereference(keyring->payload.subscriptions);
+        klist = rcu_dereference_check(keyring->payload.subscriptions,
+                                      lockdep_is_held(&key_serial_lock));
         if (!klist)
                 goto dont_gc;
 
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 8ec02746ca99..e814d2109f8e 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -151,7 +151,9 @@ static void keyring_destroy(struct key *keyring)
                 write_unlock(&keyring_name_lock);
         }
 
-        klist = rcu_dereference(keyring->payload.subscriptions);
+        klist = rcu_dereference_check(keyring->payload.subscriptions,
+                                      rcu_read_lock_held() ||
+                                      atomic_read(&keyring->usage) == 0);
         if (klist) {
                 for (loop = klist->nkeys - 1; loop >= 0; loop--)
                         key_put(klist->keys[loop]);