[RFC PATCH 2/6] keys: reclaim link quota during keyring garbage collection

Garbage collection removes dead key links without releasing their quota.
Repeated collection therefore leaves the owner charged for links that no
longer exist, eventually preventing further links with -EDQUOT.

Update the payload reservation from the surviving link count while holding
the keyring semaphore. If assoc_array_gc() fails, the tree and its count
remain unchanged, so the existing reservation is retained.

Fixes: b2a4df200d57 ("KEYS: Expand the capacity of a keyring")
Assisted-by: LLM
Signed-off-by: Jarkko Sakkinen <jarkko@kernel.org>
---
 security/keys/keyring.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 7143f3079d20..db987c891811 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c

@@ -1755,6 +1755,8 @@ void keyring_gc(struct key *keyring, time64_t limit)
 	down_write(&keyring->sem);
 	assoc_array_gc(&keyring->keys, &keyring_assoc_array_ops,
 		       keyring_gc_select_iterator, &limit);
+	key_payload_reserve(keyring,
+			    keyring->keys.nr_leaves_on_tree * KEYQUOTA_LINK_BYTES);
 	up_write(&keyring->sem);
 	kleave(" [gc]");
 }

-- 
2.47.3