[PATCH v3] KEYS: Fix key_reject_and_link() race with keyring restriction

[adrimg3196]

The restrict_link check in key_reject_and_link() is done before taking
the keyring semaphore, racing with a concurrent keyring_restrict()
that installs the restriction while holding the semaphore in write
mode.

Move the check to after __key_link_lock(), so it is done under the
semaphore, matching the pattern used in __key_create_or_update().

Fixes: 5ac7eace2d00 ("KEYS: Add a facility to restrict new links into
a keyring")
Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
Signed-off-by: Adrian Martinez <adrimg3196@xxxxxxxxx>
---
Changelog:
 v3: Add Fixes tag and Reviewed-by; resend with clean patch (v2 was corrupt).
 v2: Resend with full patch (v1 arrived without the diff).

 security/keys/key.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/security/keys/key.c b/security/keys/key.c
index 1234567..abcdefg 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -590,10 +590,17 @@ int key_reject_and_link(struct key *key,
 	ret = -EBUSY;

 	if (keyring) {
-		if (keyring->restrict_link)
-			return -EPERM;
-
 		link_ret = __key_link_lock(keyring, &key->index_key);
 		if (link_ret == 0) {
+			/*
+			 * Check the restriction under the keyring semaphore.
+			 * keyring_restrict() installs it while holding the
+			 * semaphore, so testing it beforehand races with a
+			 * concurrent restriction install.
+			 */
+			if (keyring->restrict_link) {
+				__key_link_end(keyring, &key->index_key, edit);
+				return -EPERM;
+			}
 			link_ret = __key_link_begin(keyring, &key->index_key, &edit);
 			if (link_ret < 0)
 				__key_link_end(keyring, &key->index_key, edit);