[PATCH] KEYS: Fix add_key() race with keyring restriction

[sashiko-bot at kernel.org]

> From: 성병찬 <tjdqudcks0424 at naver.com>
> 
> __key_create_or_update() snapshots keyring->restrict_link before taking
> the destination keyring's semaphore.  keyring_restrict() installs a
> restriction while holding that semaphore.
> 
> This allows a writer to observe no restriction, wait for the keyring
> owner to install a reject-all restriction and return successfully, and
> then link a key using the stale NULL snapshot.  The writer only needs
> write permission on the destination keyring.
> 
> Move the restrict_link read after __key_link_lock() and
> __key_link_begin().  The read and the subsequent restriction check are
> then serialized with restriction installation by keyring->sem.
> 
> The race was reproduced on v7.2.8 in 19 executions where restriction
> installation returned before the link completed.  All 19 linked the key
> despite the reject-all restriction.  With this change, 312 executions
> reached the same ordering and every add_key() call failed with -EPERM.
> 
> The issue was found by manual concurrency analysis assisted by AI-based
> analysis and independently verified with a QEMU reproducer and kernel
> instrumentation.
> 
> Fixes: 5ac7eace2d00 ("KEYS: Add a facility to restrict new links into a keyring")
> Cc: stable at vger.kernel.org
> Signed-off-by: 성병찬 <tjdqudcks0424 at naver.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930041802.6114-1-tjdqudcks0424@naver.com?part=1