[GIT PULL] KEYS: changes for v7.4-rc3-2

[GIT PULL] KEYS: changes for v7.4-rc3-2

[Jarkko Sakkinen]

The following changes since commit 7e1392a42ea288d70a266f6553fe06f57f8647ea:

  Merge tag 'net-7.4-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-11-12 12:26:14 -0800)

are available in the Git repository at:

  git://git.kernel.org/pub/scm/linux/kernel/git/jarkko/linux-tpmdd.git tags/keys-v7.4-rc3-2

for you to fetch changes up to bab48a1044475f62d6e910c6d7267ce4bae847f9:

  KEYS: Protect pkey method checks against type removal (2026-11-13 06:28:55 +0200)

----------------------------------------------------------------
[GIT PULL] KEYS: changes for v7.4-rc3-2

This second PR for v7.4-rc3 bundles two bug fixes:

1. Invoke the match callback before the state checks in
   keyring_search_iterator(), so that a non-matching revoked, expired or
   invalidated key cannot decide the search result.
2. Take key->sem for reading around the ->asym_*() method calls in the
   keyctl pkey operations, as a key reference does not pin the module
   providing the key type.

I decided to send this in order to get the remaining key type fixes off
the way.

As said earlier this week, I have made a patch set, making the life-time of
a key type dependent of the keys that use it at the kernel module level.
My goal is to land both rhashtable changes and key type changes to v7.5,
as that would provide a nice baseline to further improving keyrings (and
IMHO best picks as starting points overall).

Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>

----------------------------------------------------------------
Guixiong Wei (1):
      KEYS: do not let an unmatched key decide the search result

Yuansheng Yang (1):
      KEYS: Protect pkey method checks against type removal

 security/keys/keyctl_pkey.c | 100 +++++++++++++++++++++++++++++++++-----------
 security/keys/keyring.c     |  12 +++---
 2 files changed, 82 insertions(+), 30 deletions(-)