Re: [PATCH v6 0/3] KEYS: Replace assoc_array with rhashtable

[Eric Biggers]

On Sat, Nov 07, 2026 at 10:09:52PM +0200, Jarkko Sakkinen wrote:
> On Sat, Nov 07, 2026 at 09:56:01PM +0200, Jarkko Sakkinen wrote:
> > The keyrings subsystem is the sole user of assoc_array. It has over 1700
> > lines of code, no test suite, and a long history of bugs, with LLMs now
> > finding more.
> > 
> > This unfortunate outcome has evolved over time by large from the shortage
> > of in-kernel callers, time bandwidth and 3rd party contributors.
> > 
> > What the keyrings subsystem needs is just a generic key-value store, which
> > performs well with sparse key sets. Replace assoc_array with an
> > rhashtable-backed keyring index and remove assoc_array from the kernel.
> 
> Sashiko: https://sashiko.dev/#/patchset/20261107195605.3929659-1-jarkko%40kernel.org
> 
> Not addressing this as only one patch changed and the change was
> exactly:
> 
> diff --git a/security/keys/keyring.c b/security/keys/keyring.c
> index 772fa0e35f9d..6761c6801edc 100644
> --- a/security/keys/keyring.c
> +++ b/security/keys/keyring.c
> @@ -12,7 +12,6 @@
>  #include <linux/security.h>
>  #include <linux/seq_file.h>
>  #include <linux/err.h>
> -#include <linux/delay.h>
>  #include <linux/jhash.h>
>  #include <linux/user_namespace.h>
>  #include <linux/nsproxy.h>
> @@ -101,6 +100,7 @@ static const struct rhashtable_params keyring_link_params = {
>         .min_size               = 4,
>         .nelem_hint             = 3,
>         .automatic_shrinking    = true,
> +       .insecure_elasticity    = true,
>  };
> 
>  static struct keyring_index *keyring_index_locked(const struct key *keyring)
> @@ -1225,12 +1225,8 @@ int __key_link_begin(struct key *keyring,
>                 if (ret < 0)
>                         goto error;
> 
> -               do {
> -                       ret = rhashtable_insert_fast(&links->ht, &link->node,
> -                                                    keyring_link_params);
> -                       if (ret == -EBUSY)
> -                               fsleep(100);
> -               } while (ret == -EBUSY);
> +               ret = rhashtable_insert_fast(&links->ht, &link->node,
> +                                            keyring_link_params);
>                 if (ret < 0) {
>                         key_payload_reserve(keyring,
>                                             keyring->datalen - KEYQUOTA_LINK_BYTES);
> 
> So I don't think there are any real issue with the patch set, except I
> will need to rebase the commits to the latest mainline.

It looks good to me now too, but it would be good to get a Sashiko run
on the latest version.  Sashiko hasn't run since v3, as it failed to
apply the series.  You should base the series on a commit in either
mainline or linux-next, and pass the '--base' option to 'git
format-patch' so it adds a 'base-commit' line.

(The only reason I've been able to apply it myself for review is that I
went out of my way to find your keys-rhashtable branch in git.)

- Eric