Re: [PATCH] s390/cert_store: Hold the keyring->sem while invalidating keys

[Heiko Carstens]

On Sat, Oct 24, 2026 at 05:42:25PM +0300, Jarkko Sakkinen wrote:
> invalidate_keyring_keys() does not hold keyring->sem while calling
> keyring_read(), which is contrary to what keyring assumes from its callers,
> and can lead to reoccuring bugs.
> 
> KEY_FLAG_KEEP alone does not e.g.,  protect from  the following call path:
> 
> 1. keyctl_keyring_move()
> 2. key_move()
> 3. __key_unlink()
> 
> Address the issue by guarding the critical section.
> 
> Fixes: 8cf57d7217c3 ("s390: add support for user-defined certificates")
> Signed-off-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
> ---
> This came up as a side product while working on assoc_array to
> rhashtable migration and going through various callers of the keyring.
> It's made by me but please keep in mind that I don't even have a
> toolchain for s390 setup so it is based only on reading code and I have
> not even compiled this.
> 
> Just wanted to clarify the background for this fix as I'm not a regular
> contributor over here. If for any reason it turned out to be false
> positive, I'm fine with that too.

It is not a false positive. There seem to be more bugs in the code.
I'll take your patch and create a series with other fixes.

Thanks a lot!