Shaomin Chen d8274181b0 keys: Pin request_key_auth payload in instantiate paths ...

commit fd15b457a8 upstream.

A: request_key()       B: KEYCTL_INSTANTIATE_IOV
================       =========================

create auth key
store rka in auth key
wait for helper
                       get auth key
                       load rka from auth key
                       copy user payload
                       sleep on #PF

helper completed
detach and free rka
destroy auth key
                       wake up
                       use rka->target_key
                       **USE-AFTER-FREE**

Give request_key_auth payloads a refcount.  Take a payload reference while
authkey->sem stabilizes the payload and revocation state.  Hold that
reference across the instantiate and reject paths.  Drop the auth key
owning reference from revoke and destroy.

[jarkko: Replaced the first two paragraphs of text with an actual
 concurrency scenario.]
Cc: stable@vger.kernel.org # v5.10+
Fixes: b5f545c880 ("[PATCH] keys: Permit running process to instantiate keys")
Reported-by: Shaomin Chen <eeesssooo020@gmail.com>
Closes: https://lore.kernel.org/r/20260519144403.436694-1-eeesssooo020@gmail.com
Signed-off-by: Shaomin Chen <eeesssooo020@gmail.com>
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2026-07-04 13:38:40 +02:00

..

asymmetric-parser.h

…

asymmetric-subtype.h

…

asymmetric-type.h

…

big_key-type.h

…

ceph-type.h

…

dns_resolver-type.h

…

encrypted-type.h

…

keyring-type.h

…

request_key_auth-type.h

…

rxrpc-type.h

…

system_keyring.h

…

trusted_tpm.h

…

trusted-type.h

…

user-type.h

…