security/keys: fix missed RCU read section on lookup

Nicholas Carlini reports that the keyring code calls assoc_array_find()
in find_key_to_update() without holding the RCU read lock, while the
assoc_array_gc() code really is designed around removing the node from
the tree and then freeing it after an RCU grace-period.

The regular key handling doesn't see this because holding the keyring
semaphore hides any lifetime issues, but the persistent key handling
uses a different model.

Instead of extending the keyring locking, just do the simple RCU locking
that the assoc_array was designed for.

Reported-by: Nicholas Carlini <npc@anthropic.com>
Cc: David Howells <dhowells@redhat.com>
Cc: Jarkko Sakkinen <jarkko@kernel.org>
Cc: Paul Moore <paul@paul-moore.com>
Cc: James Morris James Morris <jmorris@namei.org>
Cc: Serge E. Hallyn <serge@hallyn.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index b39038f7dd3173a2cfa4ef34646ecfb7e8f7f013..5a9887d6b7be3c5e3a98b4dd8427a2c8552ed8a0 100644 (file)
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -1109,6 +1109,7 @@ key_ref_t find_key_to_update(key_ref_t keyring_ref,
        kenter("{%d},{%s,%s}",
               keyring->serial, index_key->type->name, index_key->description);
 
+       guard(rcu)();
        object = assoc_array_find(&keyring->keys, &keyring_assoc_array_ops,
                                  index_key);