[PATCH v3 0/2] keys: Fix ownership lifetime and accounting races

[Chengfeng Ye]

This series splits the previous bundled fix into two logical changes,
as requested by Jarkko.

Patch 1 protects key_user lifetime while key->user is replaced. It covers
namespace filtering, quota reservation and instantiated-key count updates,
with explicit locking at the affected access sites.

Patch 2 depends on patch 1 and extends the same critical sections so that
quota and instantiated-key accounting move together with ownership.
Notifications and reference release remain outside the spinlock.

The combined code change is identical to v2 applied to the current base.
Patch 1 fixes the lifetime race; the existing accounting races remain until
patch 2 is applied. Each commit has its own explanation and interleaving.

Changes in v3:
- Split v2 into a lifetime fix and an accounting-serialization fix.
- Rebase onto fd179f8a05be (current mainline at preparation time).
- Include a short, explicitly historical instrumented KASAN excerpt in
  patch 1, and add stable trailers for these long-standing bugs.
- Keep explicit lock acquisition at each reader; no locking accessor.

Validation:
- Built the four affected objects after each patch.
- Built the full x86_64 kernel after applying both patches, with KEYS,
  PROC_FS, USER_NS, WATCH_QUEUE and KEY_NOTIFICATIONS enabled.
- Both patches pass checkpatch --strict without errors or warnings.

Previous version:
https://lore.kernel.org/r/20260904080940.575882-1-nicoyip.dev@xxxxxxxxx/
Reviewer request:
https://lore.kernel.org/r/aqHhZO0GjMTOer4j@xxxxxxxxxx/

Chengfeng Ye (2):
  keys: Protect key_user lifetime during ownership changes
  keys: Serialize ownership transfers with key accounting

 security/keys/key.c     | 13 +++++++++++--
 security/keys/keyctl.c  |  4 ++++
 security/keys/keyring.c |  7 ++++++-
 security/keys/proc.c    | 15 +++++++++++++--
 4 files changed, 34 insertions(+), 5 deletions(-)


base-commit: fd179f8a05be3ccae366b9b96e176b51fbe54aab
-- 
2.43.0