[PATCH] keys: Pin request_key_auth payload in instantiate paths

[Jarkko Sakkinen]

On Mon, Jun 08, 2026 at 06:06:21AM +0300, Jarkko Sakkinen wrote:
> On Tue, May 26, 2026 at 10:48:38AM +0800, Shaomin Chen wrote:
> > keyctl_instantiate_key_common() reads request_key_auth from the assumed
> > auth key before copying an instantiation payload from userspace.  The copy
> > can fault and sleep.  If the request completes and revokes the auth key in
> > that window, the auth payload can be detached and freed before the
> > instantiate path uses it again.
> > 
> > A request-key helper reproducer can trigger this race.  One helper child
> > blocks in KEYCTL_INSTANTIATE_IOV while the original helper instantiates the
> > requested key and returns.  KASAN then reports a use-after-free from the
> > stale request_key_auth payload in keyctl_instantiate_key_common().
> > 
> > Give request_key_auth payloads a refcount.  Take a payload reference while
> 
> Please, name concrete things accurately. I.e. 'usage' in this case. If
> you have a name, use it instead of obfuscating generalizations.
> 
> > authkey->sem stabilizes the payload and revocation state.  Hold that
> > reference across the instantiate and reject paths.  Drop the auth key
> > owning reference from revoke and destroy.
> > 
> > Reported-by: Shaomin Chen <eeesssooo020 at gmail.com>
> > Closes: https://lore.kernel.org/r/20260519144403.436694-1-eeesssooo020@gmail.com
> > Signed-off-by: Shaomin Chen <eeesssooo020 at gmail.com>
> > ---
> >  include/keys/request_key_auth-type.h |  2 ++
> >  security/keys/internal.h             |  2 ++
> >  security/keys/keyctl.c               | 24 +++++++++++++++-----
> >  security/keys/request_key_auth.c     | 33 ++++++++++++++++++++++++++--
> >  4 files changed, 53 insertions(+), 8 deletions(-)
> 
> So first, couple of things.
> 
> I'm not going to test not that well documented involving OOT driver.

Oops, sorry typo. "not that well documented reproducer" :-)

But it is cool we just then need to draw the picture.

BR, Jarkko