From cac6a2bdb6dc25ea20c63ecfc99590ab76f1086a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Sat, 30 May 2026 12:39:14 +0200 Subject: [PATCH] 6.12-stable patches added patches: security-keys-fix-missed-rcu-read-section-on-lookup.patch --- ...ix-missed-rcu-read-section-on-lookup.patch | 43 +++++++++++++++++++ queue-6.12/series | 1 + 2 files changed, 44 insertions(+) create mode 100644 queue-6.12/security-keys-fix-missed-rcu-read-section-on-lookup.patch diff --git a/queue-6.12/security-keys-fix-missed-rcu-read-section-on-lookup.patch b/queue-6.12/security-keys-fix-missed-rcu-read-section-on-lookup.patch new file mode 100644 index 0000000000..a28ca2ebfa --- /dev/null +++ b/queue-6.12/security-keys-fix-missed-rcu-read-section-on-lookup.patch @@ -0,0 +1,43 @@ +From 43a1e3744548e6fd85873e6fb43e293eb4010694 Mon Sep 17 00:00:00 2001 +From: Linus Torvalds +Date: Thu, 28 May 2026 11:45:41 -0700 +Subject: security/keys: fix missed RCU read section on lookup + +From: Linus Torvalds + +commit 43a1e3744548e6fd85873e6fb43e293eb4010694 upstream. + +Nicholas Carlini reports that the keyring code calls assoc_array_find() +in find_key_to_update() without holding the RCU read lock, while the +assoc_array_gc() code really is designed around removing the node from +the tree and then freeing it after an RCU grace-period. + +The regular key handling doesn't see this because holding the keyring +semaphore hides any lifetime issues, but the persistent key handling +uses a different model. + +Instead of extending the keyring locking, just do the simple RCU locking +that the assoc_array was designed for. + +Reported-by: Nicholas Carlini +Cc: David Howells +Cc: Jarkko Sakkinen +Cc: Paul Moore +Cc: James Morris James Morris +Cc: Serge E. Hallyn +Signed-off-by: Linus Torvalds +Signed-off-by: Greg Kroah-Hartman +--- + security/keys/keyring.c | 1 + + 1 file changed, 1 insertion(+) + +--- a/security/keys/keyring.c ++++ b/security/keys/keyring.c +@@ -1109,6 +1109,7 @@ key_ref_t find_key_to_update(key_ref_t k + kenter("{%d},{%s,%s}", + keyring->serial, index_key->type->name, index_key->description); + ++ guard(rcu)(); + object = assoc_array_find(&keyring->keys, &keyring_assoc_array_ops, + index_key); + diff --git a/queue-6.12/series b/queue-6.12/series index 4347316992..c44303ad71 100644 --- a/queue-6.12/series +++ b/queue-6.12/series @@ -269,3 +269,4 @@ net-gro-don-t-merge-zcopy-skbs.patch loongarch-kprobes-fix-handling-of-fatal-unrecoverabl.patch landlock-fix-tcp-handling-of-short-af_unspec-address.patch block-make-bio_integrity_map_user-static-inline.patch +security-keys-fix-missed-rcu-read-section-on-lookup.patch -- 2.47.3