[RFC PATCH 2/6] keys: reclaim link quota during keyring garbage collection

[Jarkko Sakkinen]

Garbage collection removes dead key links without releasing their quota.
Repeated collection therefore leaves the owner charged for links that no
longer exist, eventually preventing further links with -EDQUOT.

Update the payload reservation from the surviving link count while holding
the keyring semaphore. If assoc_array_gc() fails, the tree and its count
remain unchanged, so the existing reservation is retained.

Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring")
Assisted-by: LLM
Signed-off-by: Jarkko Sakkinen <jarkko at kernel.org>
---
 security/keys/keyring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 7143f3079d20..db987c891811 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -1755,6 +1755,8 @@ void keyring_gc(struct key *keyring, time64_t limit)
 	down_write(&keyring->sem);
 	assoc_array_gc(&keyring->keys, &keyring_assoc_array_ops,
 		       keyring_gc_select_iterator, &limit);
+	key_payload_reserve(keyring,
+			    keyring->keys.nr_leaves_on_tree * KEYQUOTA_LINK_BYTES);
 	up_write(&keyring->sem);
 	kleave(" [gc]");
 }
-- 
2.47.3