keyctl_pkey_params_get() looks up the key, and keyctl_pkey_query(),
keyctl_pkey_e_d_s() and keyctl_pkey_verify() then dereference
key->type->asym_* outside key->sem. A reference keeps the key alive, but
does not pin the module providing its type.
unregister_key_type() calls key_gc_keytype(), which retypes every
remaining key of the type to key_type_dead under key->sem for writing.
The pkey paths read key->type again after their checks, so a concurrent
module unload can turn the checked callback into the NULL key_type_dead
member and call through a NULL function pointer, e.g.:
KEYCTL_PKEY_SIGN task Module unload and key GC
------------------------ ------------------------
keyctl_pkey_e_d_s()
if (!key->type->asym_eds_op) unregister_key_type()
[ ... ]
(925c84e3cc21) and update (aef3a8a4f988) methods.
Fixes: 00d60fd3b932 ("KEYS: Provide keyctls to drive the new key type ops for asymmetric keys [ver #2]")
Cc: <redacted>
Signed-off-by: BeaCox <redacted>
Sashiko has reviewed this patch and found no issues.
--
Sashiko AI review · https://sashiko.dev/#/patchset/20261103032940.51826-1-0xbeac@gmail.com?part=1