Re: [PATCH v6 04/11] nfit/libnvdimm: add unlock of nvdimm support for Intel DIMMs

[David Howells <dhowells@redhat.com>]

Dave Jiang <dave.jiang@intel.com> wrote:

> +	key = key_lookup(nvdimm->key_id);

You should not be using key_lookup() as the key ID doesn't pin a reference to
the key you're using.  If you're going to cache a key, either cache the key
pointer directly and check it with key_validate() before you use it or keep
the cache in a private kernel keyring and use key_search() each time you want
to use it.  The latter method allows for the key to be garbage collected
automatically if it expires or gets invalidated.

You can still follow a negative call for a cached key with a call to
nvdimm_request_key().  In the private keyring-using case, you can link the key
to the private keyring after you got it.

> +	payload = key->payload.data[0];
> +	rc = nvdimm->security_ops->unlock(nvdimm_bus, nvdimm,
> +			(void *)payload->data);

I would recommend casting to const void * if you can as you're not allowed to
change the payload data.

David
_______________________________________________
Linux-nvdimm mailing list
Linux-nvdimm@lists.01.org
https://lists.01.org/mailman/listinfo/linux-nvdimm