<div dir="ltr"><div dir="ltr"><div dir="ltr"> </div> <div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Wed, Apr 26, 2023 at 1:19 PM Tim Gardner <<a href="mailto:tim.gardner@canonical.com">tim.gardner@canonical.com</a>> wrote: </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1ex">From: David Howells <<a href="mailto:dhowells@redhat.com" target="_blank">dhowells@redhat.com</a>> BugLink: <a href="https://bugs.launchpad.net/bugs/2017801" rel="noreferrer" target="_blank">https://bugs.launchpad.net/bugs/2017801</a> [ Upstream commit 47f9e4c924025c5be87959d3335e66fcbb7f6b5c ] The key which gets cached in task structure from a kernel thread does not get invalidated even after expiry. Due to which, a new key request from kernel thread will be served with the cached key if it's present in task struct irrespective of the key validity. The change is to not cache key in task_struct when key requested from kernel thread so that kernel thread gets a valid key on every key request. The problem has been seen with the cifs module doing DNS lookups from a kernel thread and the results getting pinned by being attached to that kernel thread's cache - and thus not something that can be easily got rid of. The cache would ordinarily be cleared by notify-resume, but kernel threads don't do that. This isn't seen with AFS because AFS is doing request_key() within the kernel half of a user thread - which will do notify-resume. Fixes: 7743c48e54ee ("keys: Cache result of request_key*() temporarily in task_struct") Signed-off-by: Bharath SM <<a href="mailto:bharathsm@microsoft.com" target="_blank">bharathsm@microsoft.com</a>> Signed-off-by: David Howells <<a href="mailto:dhowells@redhat.com" target="_blank">dhowells@redhat.com</a>> Reviewed-by: Jarkko Sakkinen <<a href="mailto:jarkko@kernel.org" target="_blank">jarkko@kernel.org</a>> cc: Shyam Prasad N <<a href="mailto:nspmangalore@gmail.com" target="_blank">nspmangalore@gmail.com</a>> cc: Steve French <<a href="mailto:smfrench@gmail.com" target="_blank">smfrench@gmail.com</a>> cc: <a href="mailto:keyrings@vger.kernel.org" target="_blank">keyrings@vger.kernel.org</a> cc: <a href="mailto:linux-cifs@vger.kernel.org" target="_blank">linux-cifs@vger.kernel.org</a> cc: <a href="mailto:linux-fsdevel@vger.kernel.org" target="_blank">linux-fsdevel@vger.kernel.org</a> Link: <a href="https://lore.kernel.org/r/CAGypqWw951d=zYRbdgNR4snUDvJhWL=q3=WOyh7HhSJupjz2vA@mail.gmail.com/Signed-off-by" rel="noreferrer" target="_blank">https://lore.kernel.org/r/CAGypqWw951d=zYRbdgNR4snUDvJhWL=q3=WOyh7HhSJupjz2vA@mail.gmail.com/ Signed-off-by</a>: Sasha Levin <<a href="mailto:sashal@kernel.org" target="_blank">sashal@kernel.org</a>> (cherry picked from commit 97674f4cd05ef35963a5f73ba785582c82801982 linux-5.4.y) Signed-off-by: Tim Gardner <<a href="mailto:tim.gardner@canonical.com" target="_blank">tim.gardner@canonical.com</a>> --- security/keys/request_key.c | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/security/keys/request_key.c b/security/keys/request_key.c index 957b9e3e1492..17c9c0cfb6f5 100644 --- a/security/keys/request_key.c +++ b/security/keys/request_key.c @@ -38,9 +38,12 @@ static void cache_requested_key(struct key *key) #ifdef CONFIG_KEYS_REQUEST_CACHE struct task_struct *t = current; - key_put(t->cached_requested_key); - t->cached_requested_key = key_get(key); - set_tsk_thread_flag(t, TIF_NOTIFY_RESUME); + /* Do not cache key if it is a kernel thread */ + if (!(t->flags & PF_KTHREAD)) { + key_put(t->cached_requested_key); + t->cached_requested_key = key_get(key); + set_tsk_thread_flag(t, TIF_NOTIFY_RESUME); + } #endif } -- 2.34.1 <pre style="color:rgb(0,0,0)"> -- </pre><pre style="color:rgb(0,0,0)">Acked-by: Philip Cox <<a href="mailto:philip.cox@canonical.com">philip.cox@canonical.com</a>> </pre> </blockquote></div></div></div>