Patch "keys: Do not cache key in task struct if key is requested from kernel thread" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    keys: Do not cache key in task struct if key is requested from kernel thread

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     keys-do-not-cache-key-in-task-struct-if-key-is-reque.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 13abcad0eba8c549536ac2794d48835a7be5cfab
Author: David Howells <dhowells@xxxxxxxxxx>
Date:   Tue Mar 14 15:15:18 2023 +0000

    keys: Do not cache key in task struct if key is requested from kernel thread
    
    [ Upstream commit 47f9e4c924025c5be87959d3335e66fcbb7f6b5c ]
    
    The key which gets cached in task structure from a kernel thread does not
    get invalidated even after expiry.  Due to which, a new key request from
    kernel thread will be served with the cached key if it's present in task
    struct irrespective of the key validity.  The change is to not cache key in
    task_struct when key requested from kernel thread so that kernel thread
    gets a valid key on every key request.
    
    The problem has been seen with the cifs module doing DNS lookups from a
    kernel thread and the results getting pinned by being attached to that
    kernel thread's cache - and thus not something that can be easily got rid
    of.  The cache would ordinarily be cleared by notify-resume, but kernel
    threads don't do that.
    
    This isn't seen with AFS because AFS is doing request_key() within the
    kernel half of a user thread - which will do notify-resume.
    
    Fixes: 7743c48e54ee ("keys: Cache result of request_key*() temporarily in task_struct")
    Signed-off-by: Bharath SM <bharathsm@xxxxxxxxxxxxx>
    Signed-off-by: David Howells <dhowells@xxxxxxxxxx>
    Reviewed-by: Jarkko Sakkinen <jarkko@xxxxxxxxxx>
    cc: Shyam Prasad N <nspmangalore@xxxxxxxxx>
    cc: Steve French <smfrench@xxxxxxxxx>
    cc: keyrings@xxxxxxxxxxxxxxx
    cc: linux-cifs@xxxxxxxxxxxxxxx
    cc: linux-fsdevel@xxxxxxxxxxxxxxx
    Link: https://lore.kernel.org/r/CAGypqWw951d=zYRbdgNR4snUDvJhWL=q3=WOyh7HhSJupjz2vA@xxxxxxxxxxxxxx/
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index 957b9e3e14924..17c9c0cfb6f59 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -38,9 +38,12 @@ static void cache_requested_key(struct key *key)
 #ifdef CONFIG_KEYS_REQUEST_CACHE
 	struct task_struct *t = current;
 
-	key_put(t->cached_requested_key);
-	t->cached_requested_key = key_get(key);
-	set_tsk_thread_flag(t, TIF_NOTIFY_RESUME);
+	/* Do not cache key if it is a kernel thread */
+	if (!(t->flags & PF_KTHREAD)) {
+		key_put(t->cached_requested_key);
+		t->cached_requested_key = key_get(key);
+		set_tsk_thread_flag(t, TIF_NOTIFY_RESUME);
+	}
 #endif
 }