[PATCH] keys: fix lost wakeup when reaping a dead key type

[Jarkko Sakkinen]

On Tue, Aug 11, 2026 at 07:37:53PM +0200, Karl Mehltretter wrote:
> key_garbage_collector() clears KEY_GC_REAPING_KEYTYPE and calls
> wake_up_bit() after reaping a dead key type. wake_up_bit() uses a
> lockless waitqueue check and requires a full barrier after the clear.
> 
> The existing smp_mb() is before clear_bit(), so the GC can see an empty
> waitqueue while unregister_key_type() still sees the bit set. The final
> wakeup can then be lost, leaving module unload stuck in wait_on_bit().
> 
> Use clear_and_wake_up_bit(). Its clear_bit_unlock() preserves the
> ordering of the completed GC work, and its smp_mb__after_atomic()
> orders the clear before the waitqueue check.
> 
> Fixes: 0c061b5707ab ("KEYS: Correctly destroy key payloads when their keytype is removed")
> Assisted-by: Claude:claude-fable-5
> Signed-off-by: Karl Mehltretter <kmehltretter at gmail.com>


I think the fix good but it would be good first to have reminder that
while clear_bit() is an atomic operation as respect to the data it
holds, it is an unordered operation [1].

That is sort of the beginning of the story.

So yeah, tweak the commit message a bit and send v2.

[1] https://docs.kernel.org/core-api/wrappers/atomic_bitops.html

BR, Jarkko