Re: [PATCH v2] KEYS: do not let an unmatched key decide the search result

[sashiko-bot@kernel.org]

> With the dns_resolver key type available, put a key named "foo" in a
> fresh session keyring, revoke it, and search for "bar":
> 
>   keyctl new_session >/dev/null
>   A=$(printf '127.0.0.1\0' | keyctl padd dns_resolver foo @s)
>   keyctl revoke "$A"
>   keyctl search @s dns_resolver bar
> 
> Results:
> 
>   keyctl_search: Key has been revoked
> 
> The search returns -EKEYREVOKED even though there is no key named "bar".
> It should return -ENOKEY.
> 
> A dns_resolver search walks the keys in the keyring and uses
> dns_resolver_cmp() to compare their descriptions with the requested
> name. When keyring_search_iterator() sees the revoked "foo" key, it
> records -EKEYREVOKED in ctx->result and skips the key before comparing
> its description. The search continues, but without a match it returns
> the error recorded for "foo".
> 
> Call the match callback before checking for invalidated, revoked or
> expired keys. A nonmatching key then leaves ctx->result alone.
> 
> Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring")
> Reported-by: Jarkko Sakkinen <jarkko@kernel.org>
> Closes: https://lore.kernel.org/lkml/avDG8G-Jl1YsmfCs@kernel.org/
> Signed-off-by: Guixiong Wei <weiguixiong@bytedance.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109032931.80406-2-weiguixiong@bytedance.com?part=1