From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-pf1-f173.google.com (mail-pf1-f173.google.com [209.85.210.173]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33ED842A80 for ; Wed, 29 Jul 2026 03:37:02 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.210.173 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785296223; cv=none; b=GDBQ/kMEyM7zZHrl8Dy4xlEaINyQXQb39MUfR+JLlJe8IHQmisxXJbQ71RHyz10MZ09TLh9UVlDyuPeCHB1n+lpk3q/OHbL2/aHorLEEgFpYY58hdBv9DnCl9/8iMvljRnBzFpOySsidhcOpAgN6V+eKX5VBZ8rA/WTAus+0tls= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785296223; c=relaxed/simple; bh=fxKWOpxpMmYLzW2Pee+6A42wrQsfdKXSclEbpWEoMA8=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=i03z33YYGfKgZBEEH5kmLzY0iBltU5zRPS6lRedlbCC9ah41tXptV7gCh9E14bSHVhleH/A0OXtKse0lpUlOWQuvepGLdyM5HHwm+7QFZ5YTL5EchN8PvsMccqkjFpDzA5E0H0RNQ76nJNbOUks8xWgDPNX4z709Py0Sem8t0+w= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=l2+TXLW5; arc=none smtp.client-ip=209.85.210.173 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="l2+TXLW5" Received: by mail-pf1-f173.google.com with SMTP id d2e1a72fcca58-8487214ad2bso748987b3a.1 for ; Tue, 28 Jul 2026 20:37:02 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785296221; x=1785901021; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=ARray8b9AEh9C2cKPaqckaUEH2ujUQq7n+eTL7HUcKE=; b=l2+TXLW5p7minhgQLJnaeCClJbpgVXyXrrx1JYkmu3qJy02iqdQakokxZ78POH7J6J UGxyzCzvOAgAA97PCyB9gk2lTKmdoMMKZhQJAYDqmDB7ZmIdc95gqdW2BwJvnRCCTALe MzGxIt0aPuEQnhQXH9wFVYQQnUBcdGXmLDhs2otVgKlbllw/vnSrj26U6NRdmYRNa2rS KFYEtrM0GsdvEIEGlNdDgmvkIE2TRaSxsjqL1x52BH+03vPQ/23xbdqSv2slp1pjAih0 Xj7yGfLd7269QudN0j/zmXuLbeEawK/KqrrqCkW+mGbhZLmZNq5mO71cEonzlKSS+5QX V1Gg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785296221; x=1785901021; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=ARray8b9AEh9C2cKPaqckaUEH2ujUQq7n+eTL7HUcKE=; b=exkNzIApg8CH5780iEnppM9WJbIyvnVD0EHaf706j6cqadqx4EPgLXjm/Gx5bb5foQ bU6Jh5XjrTcZaOOXAy7sY0weowETcnKNMNbr/7VrcgAzw5HJByUSBkwTWAur1dM1Vark bN6MYaPskfLJ+++93JM9rwvUCtpuB27m3h7wUvI4HL1cRPbKZCQHEhII6MIXsSN/VmoO 61JDJGiJtEIvXwp4d0sRS07wdy7SD9JOCVCq5gQjl7TIXDr6xxCDEFGaDgU7Kf/qzkSL e2bLUg1XfiNBqoEXTOCeNKB0YR+spo/EW1fgFZtayGmzIWufNzaDVjAu9uygYUhuTxSI YdeA== X-Forwarded-Encrypted: i=1; AHgh+RobzztTg+XJUj0VPtaNI9ZkVDmsnX7T2Ip03dPiCGgOmGmGR+wN8DlTshMGz9eY/fdYgDkHID3gIAFSG3Q=@vger.kernel.org X-Gm-Message-State: AOJu0YzAylri20LSSTJXE4zhOp5mK92jBLaWsc67nThr95tTbmGmaa9r rtQ3PXcNdq/DX1NmoHYhlK/NYnNlr7mgfMgfGgfmeylNM+7ccVR+mCTe X-Gm-Gg: AR+sD10DtR8IroLmlF31YiiM8PTlEs3iytXQk7x5IyxKIYD5rtIqegZhUe2MH34NyEz SS3SS7r/1X0au22qXhYZtwjbjat6Awi9D1vTFl42x32IbVcbnLBYHY/UbZZezjpImFWlOZa1GFz kFe5UmX8mn1B2iYzVZAB2qoNnD49seFTw4uGKMFqFFW6CPDPkTxqwSvpNrWmw2LzkQdC8dFUxNx Rh1bQR6ie1cJMJ+ohjYLXB3oqI9p76LozJePDhZUogbVUC+Twx5b1waumadxSdeTAjAdrB4sNjw H3Apm3BqEEWGxLsKMUv5k/N03F1txn+MB6BWG2J6gAB9OrlAcBo2mLNyFF7+s1x8fZxfosEcwac Nj5bdvYSoBCo6c/KsOlooYzdpfMc6nGmA1KnqyLgmDa8ZWCRiV87mG0W6yE9xE1ydYB0tMGWl+3 E1u98Ecb7C8ixH+nroLEEelhbYLWqARR2fR0KeaqBuDSA= X-Received: by 2002:a05:6a00:2e28:b0:843:49f0:f5a0 with SMTP id d2e1a72fcca58-84e9321d418mr5373617b3a.32.1785296221431; Tue, 28 Jul 2026 20:37:01 -0700 (PDT) Received: from localhost ([2a09:bac5:42f3:1e14::2ff:1d]) by smtp.gmail.com with ESMTPSA id d2e1a72fcca58-84ea0055325sm696242b3a.15.2026.07.28.20.37.00 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 28 Jul 2026 20:37:01 -0700 (PDT) From: Coiby Xu To: kexec@lists.infradead.org Cc: Andrew Morton , Sourabh Jain , Baoquan He , Dave Young , Pratyush Yadav , Guangshuo Li , Coiby Xu , Bradley Morgan , "Mike Rapoport (Microsoft)" , Pasha Tatashin , Coiby Xu , linux-kernel@vger.kernel.org (open list) Subject: [PATCH v3 01/10] crash_dump: release keyring reference at the correct time Date: Wed, 29 Jul 2026 11:36:41 +0800 Message-ID: <20260729033654.311541-2-coiby.xu@gmail.com> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260729033654.311541-1-coiby.xu@gmail.com> References: <20260729033654.311541-1-coiby.xu@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Guangshuo Li restore_dm_crypt_keys_to_thread_keyring() gets a reference to the user keyring before restoring the saved dm-crypt keys. The same keyring reference is then passed to add_key_to_keyring() for each saved key, but add_key_to_keyring() drops that reference on every call. This is only balanced when exactly one key is restored. With multiple keys, the keyring reference is dropped too many times and may trigger a refcount underflow or use-after-free. When more than five keys are restored, a refcount underflow/use-after-free warning can be triggered. The early error paths after lookup_user_key() also return without dropping the keyring reference. Keep ownership of the keyring reference in restore_dm_crypt_keys_to_thread_keyring(), drop it once on all exit paths, and make add_key_to_keyring() only use the reference without consuming it. Fixes: 62f17d9df692 ("crash_dump: retrieve dm crypt keys in kdump kernel") Signed-off-by: Guangshuo Li Reviewed-and-tested-by: Coiby Xu Acked-by: Baoquan He Reviewed-by: Bradley Morgan Link: https://patch.msgid.link/20260704112509.3717884-1-lgs201920130244@gmail.com Signed-off-by: Mike Rapoport (Microsoft) Signed-off-by: Coiby Xu --- kernel/crash_dump_dm_crypt.c | 15 ++++++++++----- 1 file changed, 10 insertions(+), 5 deletions(-) diff --git a/kernel/crash_dump_dm_crypt.c b/kernel/crash_dump_dm_crypt.c index cb875ddb6ba6..c685497cd470 100644 --- a/kernel/crash_dump_dm_crypt.c +++ b/kernel/crash_dump_dm_crypt.c @@ -81,7 +81,6 @@ static int add_key_to_keyring(struct dm_crypt_key *dm_key, kexec_dprintk("Error when adding key"); } - key_ref_put(keyring_ref); return r; } @@ -104,6 +103,7 @@ static int restore_dm_crypt_keys_to_thread_keyring(void) struct dm_crypt_key *key; size_t keys_header_size; key_ref_t keyring_ref; + int ret = 0; u64 addr; /* find the target keyring (which must be writable) */ @@ -118,7 +118,8 @@ static int restore_dm_crypt_keys_to_thread_keyring(void) dm_crypt_keys_read((char *)&key_count, sizeof(key_count), &addr); if (key_count > KEY_NUM_MAX) { kexec_dprintk("Failed to read the number of dm-crypt keys\n"); - return -1; + ret = -1; + goto out; } kexec_dprintk("There are %u keys\n", key_count); @@ -126,8 +127,10 @@ static int restore_dm_crypt_keys_to_thread_keyring(void) keys_header_size = get_keys_header_size(key_count); keys_header = kzalloc(keys_header_size, GFP_KERNEL); - if (!keys_header) - return -ENOMEM; + if (!keys_header) { + ret = -ENOMEM; + goto out; + } dm_crypt_keys_read((char *)keys_header, keys_header_size, &addr); @@ -137,7 +140,9 @@ static int restore_dm_crypt_keys_to_thread_keyring(void) add_key_to_keyring(key, keyring_ref); } - return 0; +out: + key_ref_put(keyring_ref); + return ret; } static int read_key_from_user_keyring(struct dm_crypt_key *dm_key) -- 2.55.0