Re: [PATCH] KEYS: Fix key_reject_and_link() race with keyring restriction

[Jarkko Sakkinen]

On Thu, Oct 08, 2026 at 03:51:32AM -0700, adrimg3196@xxxxxxxxx wrote:
> The restrict_link check in key_reject_and_link() is done before taking
> the keyring semaphore, racing with a concurrent keyring_restrict()
> that installs the restriction while holding the semaphore in write
> mode.
> 
> This is the same pattern that commit dd3ea3fc ("KEYS: Fix add_key()
> race with keyring restriction") just fixed in __key_create_or_update()
> by moving the restrict_link snapshot to after the semaphore is taken.
> 
> Move the check under __key_link_lock() so a restriction installed
> concurrently cannot be bypassed when linking a negative key.
> 
> Signed-off-by: Adrian Martinez <adrimg3196@xxxxxxxxx>
> ---
>  security/keys/key.c | 17 +++++++++++------
>  1 file changed, 11 insertions(+), 6 deletions(-)
> 

Something went wrong I guess? That's fine. I'm just pointing out
that there's no code change.

Br, Jarkko