* [PATCH] KEYS: Fix key_reject_and_link() race with keyring restriction
@ 2026-10-08 10:51 adrimg3196
2026-10-08 17:58 ` Jarkko Sakkinen
0 siblings, 1 reply; 2+ messages in thread
From: adrimg3196 @ 2026-10-08 10:51 UTC (permalink / raw)
To: linux-kernel; +Cc: keyrings, dhowells
The restrict_link check in key_reject_and_link() is done before taking
the keyring semaphore, racing with a concurrent keyring_restrict()
that installs the restriction while holding the semaphore in write
mode.
This is the same pattern that commit dd3ea3fc ("KEYS: Fix add_key()
race with keyring restriction") just fixed in __key_create_or_update()
by moving the restrict_link snapshot to after the semaphore is taken.
Move the check under __key_link_lock() so a restriction installed
concurrently cannot be bypassed when linking a negative key.
Signed-off-by: Adrian Martinez <adrimg3196@gmail.com>
---
security/keys/key.c | 17 +++++++++++------
1 file changed, 11 insertions(+), 6 deletions(-)
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: [PATCH] KEYS: Fix key_reject_and_link() race with keyring restriction
2026-10-08 10:51 [PATCH] KEYS: Fix key_reject_and_link() race with keyring restriction adrimg3196
@ 2026-10-08 17:58 ` Jarkko Sakkinen
0 siblings, 0 replies; 2+ messages in thread
From: Jarkko Sakkinen @ 2026-10-08 17:58 UTC (permalink / raw)
To: adrimg3196; +Cc: linux-kernel, keyrings, dhowells
On Thu, Oct 08, 2026 at 03:51:32AM -0700, adrimg3196@gmail.com wrote:
> The restrict_link check in key_reject_and_link() is done before taking
> the keyring semaphore, racing with a concurrent keyring_restrict()
> that installs the restriction while holding the semaphore in write
> mode.
>
> This is the same pattern that commit dd3ea3fc ("KEYS: Fix add_key()
> race with keyring restriction") just fixed in __key_create_or_update()
> by moving the restrict_link snapshot to after the semaphore is taken.
>
> Move the check under __key_link_lock() so a restriction installed
> concurrently cannot be bypassed when linking a negative key.
>
> Signed-off-by: Adrian Martinez <adrimg3196@gmail.com>
> ---
> security/keys/key.c | 17 +++++++++++------
> 1 file changed, 11 insertions(+), 6 deletions(-)
>
Something went wrong I guess? That's fine. I'm just pointing out
that there's no code change.
Br, Jarkko
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2026-10-08 17:58 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-10-08 10:51 [PATCH] KEYS: Fix key_reject_and_link() race with keyring restriction adrimg3196
2026-10-08 17:58 ` Jarkko Sakkinen
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®