[PATCH v2 3/6] KEYS: Verify the key identity in __key_unlink_begin

[sashiko-bot at kernel.org]

> When two keys have identical type and description, linking the second key
> replaces the first in a keyring. However, attempting to unlink the first
> key (no longer in the keyring) unlinks the second key.
> 
> This happens because __key_unlink_begin() calls assoc_array_delete() with
> &key->index_key, matching only on type and description rather than the
> key's identity.
> 
> Example:
> 
>   keyctl new_session >/dev/null
>   keyctl newring ring_a @s
>   keyctl newring ring_b @s
>   A=$(keyctl add user A ss %:ring_a)
>   B=$(keyctl add user A qq %:ring_b)
> [ ... ]
> Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring")
> Reviewed-by: David Howells <dhowells at redhat.com>
> Reviewed-by: Eric Biggers <ebiggers at kernel.org>
> Link: https://lore.kernel.org/r/20261020174325.2229448-4-jarkko@kernel.org
> Signed-off-by: Jarkko Sakkinen <jarkko at kernel.org>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261023120953.1206778-1-jarkko@kernel.org?part=3