Shaomin Chen fd15b457a8 keys: Pin request_key_auth payload in instantiate paths ... A: request_key() B: KEYCTL_INSTANTIATE_IOV ================ ========================= create auth key store rka in auth key wait for helper get auth key load rka from auth key copy user payload sleep on #PF helper completed detach and free rka destroy auth key wake up use rka->target_key **USE-AFTER-FREE** Give request_key_auth payloads a refcount. Take a payload reference while authkey->sem stabilizes the payload and revocation state. Hold that reference across the instantiate and reject paths. Drop the auth key owning reference from revoke and destroy. [jarkko: Replaced the first two paragraphs of text with an actual concurrency scenario.] Cc: stable@vger.kernel.org # v5.10+ Fixes: b5f545c880 ("[PATCH] keys: Permit running process to instantiate keys") Reported-by: Shaomin Chen <eeesssooo020@gmail.com> Closes: https://lore.kernel.org/r/20260519144403.436694-1-eeesssooo020@gmail.com Signed-off-by: Shaomin Chen <eeesssooo020@gmail.com> Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>		2026-06-15 15:19:13 +03:00
..
asymmetric-parser.h	KEYS: Add forward declaration in asymmetric-parser.h	2023-06-23 16:15:37 +08:00
asymmetric-subtype.h
asymmetric-type.h	keys: Annotate struct asymmetric_key_id with __counted_by	2025-10-31 17:43:56 +08:00
big_key-type.h
ceph-type.h
dns_resolver-type.h	KEYS: Remove unused declarations	2024-09-20 18:28:26 +03:00
encrypted-type.h
keyring-type.h
request_key_auth-type.h	keys: Pin request_key_auth payload in instantiate paths	2026-06-15 15:19:13 +03:00
rxrpc-type.h	rxrpc: Add YFS RxGK (GSSAPI) security class	2025-04-14 17:36:41 -07:00
system_keyring.h	keys: drop shadowing dead prototype	2025-01-21 11:25:23 +02:00
trusted_caam.h	KEYS: trusted: Introduce support for NXP CAAM-based trusted keys	2022-05-23 18:47:50 +03:00
trusted_dcp.h	KEYS: trusted: Introduce NXP DCP-backed trusted keys	2024-05-09 18:29:03 +03:00
trusted_pkwm.h	keys/trusted_keys: establish PKWM as a trusted source	2026-01-30 09:27:26 +05:30
trusted_tee.h	KEYS: trusted: Introduce TEE based Trusted Keys	2021-04-14 16:30:30 +03:00
trusted_tpm.h	KEYS: trusted_tpm1: Move private functionality out of public header	2025-09-27 21:05:06 +03:00
trusted-type.h	KEYS: trusted: Debugging as a feature	2026-06-15 15:19:12 +03:00
user-type.h