[PATCH v4 2/2] keys: Serialize ownership transfers with key accounting

[Chengfeng Ye]

On Wed, Oct 14, 2026 at 7:44 PM Jarkko Sakkinen <jarkko at kernel.org> wrote:
>
> On Wed, Oct 14, 2026 at 02:36:53PM +0300, Jarkko Sakkinen wrote:
> > On Tue, Oct 13, 2026 at 05:03:58PM +0800, Chengfeng Ye wrote:
> > > Protecting individual accesses to key->user does not make ownership
> > > transfers atomic with accounting updates. keyctl_chown_key() holds
> > > key->sem, but instantiation is serialized by key_construction_mutex and
> > > need not hold that semaphore. KEY_LOOKUP_PARTIAL also permits chown of
> > > an uninstantiated key.
> > >
> > > The instantiated-key count can therefore be charged to the wrong owner:
> > >
> > >   instantiate                       keyctl_chown_key()
> > >   increment old->nikeys
> > >                                     observe KEY_IS_UNINSTANTIATED
> > >                                     skip the nikeys transfer
> > >                                     replace key->user
> > >   mark key instantiated
> >
> >
> > Same here there's another below.
>
> This was also asked last time. Actually last time (since I missed the
> spurious comment), this was the only thing that wask from you.
>
> Br, Jarkko

I'll also try to address the same changelog clarity problem in 2/2 (so
as the spurious comment). Apologies again for the messy changelog.

Best regards,
Chengfeng