[PATCH v4 2/2] keys: Serialize ownership transfers with key accounting

[Jarkko Sakkinen]

On Wed, Oct 14, 2026 at 02:36:53PM +0300, Jarkko Sakkinen wrote:
> On Tue, Oct 13, 2026 at 05:03:58PM +0800, Chengfeng Ye wrote:
> > Protecting individual accesses to key->user does not make ownership
> > transfers atomic with accounting updates. keyctl_chown_key() holds
> > key->sem, but instantiation is serialized by key_construction_mutex and
> > need not hold that semaphore. KEY_LOOKUP_PARTIAL also permits chown of
> > an uninstantiated key.
> > 
> > The instantiated-key count can therefore be charged to the wrong owner:
> > 
> >   instantiate                       keyctl_chown_key()
> >   increment old->nikeys
> >                                     observe KEY_IS_UNINSTANTIATED
> >                                     skip the nikeys transfer
> >                                     replace key->user
> >   mark key instantiated
> 
> 
> Same here there's another below.

This was also asked last time. Actually last time (since I missed the
spurious comment), this was the only thing that wask from you.

Br, Jarkko