Re: [PATCH] KEYS: do not let an unmatched key decide the search result

[sashiko-bot@kernel.org]

> KEYCTL_SEARCH returns -ENOKEY, -EKEYREVOKED, or -EKEYEXPIRED for the key
> selected by type and description.  keyring_search_iterator() currently
> records revoked or expired state before asking the key type whether the key
> matches.
> 
> Direct lookup visits the indexed description, so that ordering normally
> does not matter.  Iterative lookup visits every key of the requested type,
> however.  The in-tree asymmetric id/ex/dn lookups and dns_resolver use this
> mode.  A revoked key with a different description can therefore make
> KEYCTL_SEARCH return -EKEYREVOKED instead of continuing the search.  It can
> also prevent request_key_and_link() from issuing an upcall because that
> path only upcalls after -EAGAIN.  An unmatched expired key similarly
> pollutes searches that do not set KEYRING_SEARCH_SKIP_EXPIRED; the request
> path itself sets that flag.
> 
> Run the type comparator before recording state errors, so only a key that
> matches the caller's criterion can decide the search result.
> 
> Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring")
> Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261108131413.12012-2-weiguixiong@bytedance.com?part=1