Re: [PATCH v6 0/3] KEYS: Replace assoc_array with rhashtable

[Jarkko Sakkinen]

On Sat, Nov 07, 2026 at 12:42:10PM -0800, Eric Biggers wrote:
> On Sat, Nov 07, 2026 at 10:09:52PM +0200, Jarkko Sakkinen wrote:
> > On Sat, Nov 07, 2026 at 09:56:01PM +0200, Jarkko Sakkinen wrote:
> > > The keyrings subsystem is the sole user of assoc_array. It has over 1700
> > > lines of code, no test suite, and a long history of bugs, with LLMs now
> > > finding more.
> > > 
> > > This unfortunate outcome has evolved over time by large from the shortage
> > > of in-kernel callers, time bandwidth and 3rd party contributors.
> > > 
> > > What the keyrings subsystem needs is just a generic key-value store, which
> > > performs well with sparse key sets. Replace assoc_array with an
> > > rhashtable-backed keyring index and remove assoc_array from the kernel.
> > 
> > Sashiko: https://sashiko.dev/#/patchset/20261107195605.3929659-1-jarkko%40kernel.org
> > 
> > Not addressing this as only one patch changed and the change was
> > exactly:
> > 
> > diff --git a/security/keys/keyring.c b/security/keys/keyring.c
> > index 772fa0e35f9d..6761c6801edc 100644
> > --- a/security/keys/keyring.c
> > +++ b/security/keys/keyring.c
> > @@ -12,7 +12,6 @@
> >  #include <linux/security.h>
> >  #include <linux/seq_file.h>
> >  #include <linux/err.h>
> > -#include <linux/delay.h>
> >  #include <linux/jhash.h>
> >  #include <linux/user_namespace.h>
> >  #include <linux/nsproxy.h>
> > @@ -101,6 +100,7 @@ static const struct rhashtable_params keyring_link_params = {
> >         .min_size               = 4,
> >         .nelem_hint             = 3,
> >         .automatic_shrinking    = true,
> > +       .insecure_elasticity    = true,
> >  };
> > 
> >  static struct keyring_index *keyring_index_locked(const struct key *keyring)
> > @@ -1225,12 +1225,8 @@ int __key_link_begin(struct key *keyring,
> >                 if (ret < 0)
> >                         goto error;
> > 
> > -               do {
> > -                       ret = rhashtable_insert_fast(&links->ht, &link->node,
> > -                                                    keyring_link_params);
> > -                       if (ret == -EBUSY)
> > -                               fsleep(100);
> > -               } while (ret == -EBUSY);
> > +               ret = rhashtable_insert_fast(&links->ht, &link->node,
> > +                                            keyring_link_params);
> >                 if (ret < 0) {
> >                         key_payload_reserve(keyring,
> >                                             keyring->datalen - KEYQUOTA_LINK_BYTES);
> > 
> > So I don't think there are any real issue with the patch set, except I
> > will need to rebase the commits to the latest mainline.
> 
> It looks good to me now too, but it would be good to get a Sashiko run
> on the latest version.  Sashiko hasn't run since v3, as it failed to
> apply the series.  You should base the series on a commit in either
> mainline or linux-next, and pass the '--base' option to 'git
> format-patch' so it adds a 'base-commit' line.
> 
> (The only reason I've been able to apply it myself for review is that I
> went out of my way to find your keys-rhashtable branch in git.)
> 
> - Eric

I think know what is the problem here exactly. It's the prepending bug
fixes. Sorry, I only now realized this althouhgh it should be quite
obvious.

I updated mainline few days for the sake of v7.4-rcX PRs late this
week (I think it was Thu or Fri) but linux-next was not up to date
last time I checked.

One I'm able to send the PR containing the fixes, I'll do that and
once that is in the mainline. I'll send a new version of this patch
set.

Br, Jarkko