[PATCH] keys: Check the authorization payload in process keyring searches

[sashiko-bot at kernel.org]

> An authorization payload and its saved credentials must remain valid
> while search_process_keyrings_rcu() searches the requestor's keyrings.
> The function validates the authorization key, then separately loads
> payload.data[0] and unconditionally reads rka->cred. Validation does
> not prevent request_key_auth_revoke() from clearing the payload.
> 
> A request-key helper can assume authority and fork a descendant that
> inherits the authorization key. If the descendant misses in its own
> keyrings, it falls back to the saved requestor credentials. Successful
> target instantiation invalidates the authorization key without clearing
> the payload. After the helper exits, UMH_WAIT_PROC returns to the
> requester, which calls complete_request_key() and revokes that key.
> 
> With the descendant paused after validation, the paths can interleave
> as follows:
> [ ... ]
>     RIP: 0010:search_process_keyrings_rcu+0x32b/0x790
> 
> Fixes: e59428f721ee ("keys: Move the RCU locks outwards from the keyring search functions")
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427 at gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/pm-key-management-objects-candidate-0004-v3-598361863b76bc25d58d@gmail.com?part=1