mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git
synced 2026-10-30 22:03:17 +01:00
Shaomin Chen
fd15b457a8
A: request_key() B: KEYCTL_INSTANTIATE_IOV
================ =========================
create auth key
store rka in auth key
wait for helper
get auth key
load rka from auth key
copy user payload
sleep on #PF
helper completed
detach and free rka
destroy auth key
wake up
use rka->target_key
**USE-AFTER-FREE**
Give request_key_auth payloads a refcount. Take a payload reference while
authkey->sem stabilizes the payload and revocation state. Hold that
reference across the instantiate and reject paths. Drop the auth key
owning reference from revoke and destroy.
[jarkko: Replaced the first two paragraphs of text with an actual
concurrency scenario.]
Cc: [email protected] # v5.10+
Fixes: b5f545c880 ("[PATCH] keys: Permit running process to instantiate keys")
Reported-by: Shaomin Chen <[email protected]>
Closes: https://lore.kernel.org/r/[email protected]
Signed-off-by: Shaomin Chen <[email protected]>
Signed-off-by: Jarkko Sakkinen <[email protected]>