[PATCH v3] keys: finalize persistent keyring timeout after link attempt

[Karl Mehltretter]

On Wed, Sep 02, 2026 at 02:00:56AM +0100, Jarkko Sakkinen wrote:
> > +		*persistent_ref = find_key_to_update(reg_ref, index_key);
> > +		if (*persistent_ref)
> > +			return 1;
> 
> I'd return -ENOENT here instead and not make return value tristate.
> 

I don't think using an error to mean "found" is safe. keyring_alloc()
can return -ENOENT through security_key_alloc(). A BPF LSM key_alloc
hook can return any errno.

I checked this in QEMU with a BPF LSM hook returning -ENOENT.
keyring_alloc(".persistent_register") returned -ENOENT and
KEYCTL_GET_PERSISTENT failed with ENOENT.

So -ENOENT would be ambiguous. I also considered +EEXIST instead of 1,
but that seems a bit too clever. I'd rather keep 0/1/<0.

Thanks,
Karl