Re: [PATCH] fscrypt: Add missing superblock check in find_or_insert_direct_key()

[Eric Biggers <ebiggers@kernel.org>]

On Sat, Jul 18, 2026 at 08:31:20PM -0700, Eric Biggers wrote:
> The legacy 'fscrypt_direct_keys' table caches master keys that are used
> by v1 encryption policies that have FSCRYPT_POLICY_FLAG_DIRECT_KEY.
> It's just a global table for all filesystems (since the keys can be
> provided by the legacy process-subscribed keyrings mechanism, which
> makes it difficult to reuse super_block::s_master_keys).
> 
> The entries in it ('struct fscrypt_direct_key') do contain a super_block
> pointer, though, for passing to fscrypt_destroy_inline_crypt_key() when
> the last inode that references the key is evicted.
> 
> However, when finding the fscrypt_direct_key for an inode, we weren't
> actually comparing the super_block pointer.  As a result, inodes with
> different super_blocks could point to the same fscrypt_direct_key.  That
> could extend the lifetime of a fscrypt_direct_key beyond the
> super_block it points to, causing a use-after-free later.
> 
> Fix this by creating distinct fscrypt_direct_key structs for distinct
> super_block structs.
> 
> Note that this problem doesn't exist in the v2 policy equivalent
> ("per-mode keys"), since the data structures there are per super_block.
> 
> Fixes: 22e9947a4b2b ("fscrypt: stop holding extra request_queue references")
> Cc: stable@vger.kernel.org
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>

Applied to https://git.kernel.org/pub/scm/fs/fscrypt/linux.git/log/?h=for-current

- Eric