From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pl1-f171.google.com (mail-pl1-f171.google.com [209.85.214.171]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0099333D6E6 for ; Wed, 3 Jun 2026 13:58:08 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.214.171 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780495096; cv=none; b=eJl5OGpgtNkN0Kph2G4Eg2Pv33zYbiLHwMtjOZMPQBoBT/3EWE6tjk3+qDif1gNwoYK7U78Re7za4+L9cGqXOJ6KjC/hyEZJ8l+lkHP5RMxb0n10hGfD+3pN5TmqQIBbGwXnjXrV3hlHfJDURnMdn7Iaw7E6MIZ2i71xMS6f9/U= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780495096; c=relaxed/simple; bh=aLI7YMH0toN3Ew0wZsFH+ckKvKXJxHXZ2FwBjAnnH5I=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=kkKxVnlogQe80YVY9rwDZDSfDDK4WXW+TCjtHQ68NKijSrRa7lk12674/GQBcQcuVs/Hw/8X2BvIA/nCmDMmzYPWkB+UgfjUwyXx2Zz9TgtV0RNe5Jp51HF9camOI+GFeZWewiwZeLwr5yw5lskAiZ81dUwj2rPSSIr8l444JnQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=IGoGlNGN; arc=none smtp.client-ip=209.85.214.171 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="IGoGlNGN" Received: by mail-pl1-f171.google.com with SMTP id d9443c01a7336-2c0c1e0d00bso36577555ad.0 for ; Wed, 03 Jun 2026 06:58:08 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780495088; x=1781099888; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=jk62JU5ik5+dUH1rmHCPjoy12XeXhXtNgodX+2d0sIM=; b=IGoGlNGNJtmU22iMBtOfAkjaIIpHTmLVuxRvvsT7y3defDjJjl0VGmp7JLS24Q6Hny FYy0j+FhvWxsaW3Yefktz9aNkR8PS/Fda2IKcROvdznS8867PopLH6j3f8O/R8GtsKvZ 17sg/KQCXKEagLm3vEfYybqUA1TahK8JblVZUa96D3XHWYteoYscyexbt0BxJ7LXvESh Lp9UPcAwMlI/Y14q25f5ogbI02OyJITm1INVsJW3GFp5fSQzIgHCnb1xbmqyfe4+oKdJ LRSEACxs0kf+oRU9md6l3OZTIbObKkBdP1or/VeS9xUI0/lEmkglXy7gec1//kIft5QN jWmA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780495088; x=1781099888; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=jk62JU5ik5+dUH1rmHCPjoy12XeXhXtNgodX+2d0sIM=; b=Pb4l3CSiWvmPETvVUxI4Shp4bxQtVX2ERso9lMJHPuI7e0Yzw6wZWrdD8lcCX6KRZa wrMMDCSnOc0UXC2dIzRWDb7zcybZppVXVr5TpdtbiTdCfhkdSW1yWEdX7vwdb5DU0665 fCgOLFnB5DY1B7stguPmrZKjjxzCokKdaP3t1QMQZjWOsSXr8CbwSCmP+RarXrzG2PFN RZxE8bdqE72dbJjTbvX5kU4tccfkIkC0aPccSYB+GRfM2PADk3PqRVYkNhCQjj3niod8 7jlgECssL1lKWmHZmn3Rw4PmWxGfSRRU2eTyG4lzYgBt0q+gJZTAMPfFyjt28ZTlMdyt Bh0Q== X-Forwarded-Encrypted: i=1; AFNElJ9qFSsX7FSZZqyZ4+KLv8b3mpCvBKTpMWM/RQ+Cm1xl/UxQkeA9vBB3BXInTw8AEXf4d9LBrWKAX4E2Lco=@vger.kernel.org X-Gm-Message-State: AOJu0Yz5aZyjiwnKvGoWWqPb173gRL+1kDdyVrbU6YRaLiyIhrWYoVMO 1yMxqsZ2Zmc+SA2v28+AZKiInerh6+7IgzEcEKZqQaoD5udYzs9ywnEs X-Gm-Gg: Acq92OFVCeu1Y485v9sa1AKGdmD342+kBixKD0ZzXELCPj9XHB2VGbUF2leZfIbnut+ f9q2G6x30CdmjwfDLzW162F2XampGodYLqJzZJmbxudpqNJRhQ5o/eD12VnpR9ynk952r1xOrcv lteL6WgxyvBoA4SusIYjOy+19GpuNpWJYCWnp7oW3mDpC5C84IBO6TzpZ2M7eu50nhTMI7brtWQ jGR7ud+tWnTqocA3YTFCqp09ZsIwLt4ZUyJMfHrv9bTfUpHaLVAXMFOAzJb40tRr4+mme7DtbcC Ev/nEDOkdVIoSws/v1EbYf/rIqzK5azwbXOj3OP2rviODtwSTyX6AcaNQ+LFC4b/qK5kxjgDBnU j8x2LgAikcn666GxrCyKu8rhrktP614MMrypC6hipjPZnPGBvjUwD8und2CAlKNwzCzLukzARMz oo87+BVyWOryhmo66w X-Received: by 2002:a17:903:234c:b0:2bc:eea4:83c3 with SMTP id d9443c01a7336-2c163fa4889mr36746735ad.25.1780495088038; Wed, 03 Jun 2026 06:58:08 -0700 (PDT) Received: from lgs.. ([2001:250:5800:1000::f280]) by smtp.gmail.com with ESMTPSA id d9443c01a7336-2c16609e096sm27109875ad.44.2026.06.03.06.58.04 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 03 Jun 2026 06:58:07 -0700 (PDT) From: Guangshuo Li To: Andrew Morton , Baoquan He , Vivek Goyal , Dave Young , Coiby Xu , kexec@lists.infradead.org, linux-kernel@vger.kernel.org Cc: Guangshuo Li Subject: [PATCH] crash_dump: release keyring reference at the correct time Date: Wed, 3 Jun 2026 21:50:56 +0800 Message-ID: <20260603135056.1397084-1-lgs201920130244@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit restore_dm_crypt_keys_to_thread_keyring() gets a reference to the user keyring before restoring the saved dm-crypt keys. The same keyring reference is then passed to add_key_to_keyring() for each saved key, but add_key_to_keyring() drops that reference on every call. This is only balanced when exactly one key is restored. With multiple keys, the keyring reference is dropped too many times and may trigger a refcount underflow or use-after-free. The early error paths after lookup_user_key() also return without dropping the keyring reference. Keep ownership of the keyring reference in restore_dm_crypt_keys_to_thread_keyring(), drop it once on all exit paths, and make add_key_to_keyring() only use the reference without consuming it. Fixes: 62f17d9df692 ("crash_dump: retrieve dm crypt keys in kdump kernel") Signed-off-by: Guangshuo Li --- kernel/crash_dump_dm_crypt.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c index a20d4097744a..641c290f1270 100644 --- a/kernel/crash_dump_dm_crypt.c +++ b/kernel/crash_dump_dm_crypt.c @@ -80,7 +80,6 @@ static int add_key_to_keyring(struct dm_crypt_key *dm_key, kexec_dprintk("Error when adding key"); } - key_ref_put(keyring_ref); return r; } @@ -104,6 +103,7 @@ static int restore_dm_crypt_keys_to_thread_keyring(void) size_t keys_header_size; key_ref_t keyring_ref; u64 addr; + int ret = 0; /* find the target keyring (which must be writable) */ keyring_ref = @@ -117,7 +117,8 @@ static int restore_dm_crypt_keys_to_thread_keyring(void) dm_crypt_keys_read((char *)&key_count, sizeof(key_count), &addr); if (key_count < 0 || key_count > KEY_NUM_MAX) { kexec_dprintk("Failed to read the number of dm-crypt keys\n"); - return -1; + ret = -1; + goto out; } kexec_dprintk("There are %u keys\n", key_count); @@ -125,8 +126,10 @@ static int restore_dm_crypt_keys_to_thread_keyring(void) keys_header_size = get_keys_header_size(key_count); keys_header = kzalloc(keys_header_size, GFP_KERNEL); - if (!keys_header) - return -ENOMEM; + if (!keys_header) { + ret = -ENOMEM; + goto out; + } dm_crypt_keys_read((char *)keys_header, keys_header_size, &addr); @@ -136,7 +139,9 @@ static int restore_dm_crypt_keys_to_thread_keyring(void) add_key_to_keyring(key, keyring_ref); } - return 0; +out: + key_ref_put(keyring_ref); + return ret; } static int read_key_from_user_keying(struct dm_crypt_key *dm_key) -- 2.43.0