[PATCH] keys: Avoid owner account dereferences in /proc/keys

[sashiko-bot at kernel.org]

> The namespace filters in find_ge_key() and key_serial_next() read
> key->user->uid while traversing the serial tree under key_serial_lock.
> That lock keeps the key allocated, but it does not protect the separate
> key_user from ownership changes.
> 
> A /proc/keys read reaches find_ge_key() through proc_keys_start(), and
> key_serial_next() through proc_keys_next(). The lock stays held until
> proc_keys_stop().
> 
> A successful privileged KEYCTL_CHOWN on the same key replaces key->user
> under key->sem and drops the old owner's reference after releasing the
> semaphore. If that was the old dynamic key_user's last reference, a
> /proc/keys reader can access freed memory:
> 
>     /proc/keys reader                   KEYCTL_CHOWN
> [ ... ]
> 
> Fixes: 454804ab0302 ("keys: make procfiles per-user-namespace")
> Suggested-by: Eric Biggers <ebiggers at kernel.org>
> Assisted-by: LLM
> Signed-off-by: Cen Zhang <zzzccc427 at gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/pm-keys-proc-owner-uid-followup-20261017-v2-8f8f34a41eb1bbb94ef0@gmail.com?part=1