From: David Howells <dhowells@redhat.com>

Subject: [PATCH] KEYS: Fix RCU no-lock warning in keyctl_session_to_parent()

There's an protected access to the parent process's credentials in the middle

of keyctl_session_to_parent().  This results in the following RCU warning:

===================================================

[ INFO: suspicious rcu_dereference_check() usage. ]

---------------------------------------------------

security/keys/keyctl.c:1291 invoked rcu_dereference_check() without protection!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0

1 lock held by keyctl-session-/2137:

 #0:  (tasklist_lock){.+.+..}, at: [<ffffffff811ae2ec>] keyctl_session_to_parent+0x60/0x236

stack backtrace:

Pid: 2137, comm: keyctl-session- Not tainted 2.6.36-rc2-cachefs+ #1

Call Trace:

 [<ffffffff8105606a>] lockdep_rcu_dereference+0xaa/0xb3

 [<ffffffff811ae379>] keyctl_session_to_parent+0xed/0x236

 [<ffffffff811af77e>] sys_keyctl+0xb4/0xb6

 [<ffffffff81001eab>] system_call_fastpath+0x16/0x1b

The code should take the RCU read lock to make sure the parents credentials

don't go away, even though it's holding a spinlock and has IRQ disabled.

Signed-off-by: David Howells <dhowells@redhat.com>

---

 security/keys/keyctl.c |    3 +++

 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c

index b2b0998..3868c67 100644

--- a/security/keys/keyctl.c

+++ b/security/keys/keyctl.c

@@ -1272,6 +1272,7 @@ long keyctl_session_to_parent(void)

 	keyring_r = NULL;

 	me = current;

+	rcu_read_lock();

 	write_lock_irq(&tasklist_lock);

 	parent = me->real_parent;

@@ -1319,6 +1320,7 @@ long keyctl_session_to_parent(void)

 	set_ti_thread_flag(task_thread_info(parent), TIF_NOTIFY_RESUME);

 	write_unlock_irq(&tasklist_lock);

+	rcu_read_unlock();

 	if (oldcred)

 		put_cred(oldcred);

 	return 0;

@@ -1327,6 +1329,7 @@ already_same:

 	ret = 0;

 not_permitted:

 	write_unlock_irq(&tasklist_lock);

+	rcu_read_unlock();

 	put_cred(cred);

 	return ret;