From: sashiko-bot@kernel.org
Cc: linux-security-module@vger.kernel.org
Subject: Re: [PATCH] KEYS: Fix add_key() race with keyring restriction
Date: Wed, 30 Sep 2026 04:28:06 +0000 [thread overview]
Message-ID: <20260930042806.AABFB1F000FF@smtp.kernel.org> (raw)
In-Reply-To: <20260930041802.6114-1-tjdqudcks0424@naver.com>
> From: 성병찬 <tjdqudcks0424@naver.com>
>
> __key_create_or_update() snapshots keyring->restrict_link before taking
> the destination keyring's semaphore. keyring_restrict() installs a
> restriction while holding that semaphore.
>
> This allows a writer to observe no restriction, wait for the keyring
> owner to install a reject-all restriction and return successfully, and
> then link a key using the stale NULL snapshot. The writer only needs
> write permission on the destination keyring.
>
> Move the restrict_link read after __key_link_lock() and
> __key_link_begin(). The read and the subsequent restriction check are
> then serialized with restriction installation by keyring->sem.
>
> The race was reproduced on v7.2.8 in 19 executions where restriction
> installation returned before the link completed. All 19 linked the key
> despite the reject-all restriction. With this change, 312 executions
> reached the same ordering and every add_key() call failed with -EPERM.
>
> The issue was found by manual concurrency analysis assisted by AI-based
> analysis and independently verified with a QEMU reproducer and kernel
> instrumentation.
>
> Fixes: 5ac7eace2d00 ("KEYS: Add a facility to restrict new links into a keyring")
> Cc: stable@vger.kernel.org
> Signed-off-by: 성병찬 <tjdqudcks0424@naver.com>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/20260930041802.6114-1-tjdqudcks0424@naver.com?part=1
next prev parent reply other threads:[~2026-09-30 4:28 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-30 4:18 [PATCH] KEYS: Fix add_key() race with keyring restriction tjdqudcks0424
2026-09-30 4:28 ` sashiko-bot [this message]
2026-10-02 3:18 ` Jarkko Sakkinen
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260930042806.AABFB1F000FF@smtp.kernel.org \
--to=sashiko-bot@kernel.org \
--cc=linux-security-module@vger.kernel.org \
--cc=sashiko-reviews@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.